Are you not reporting it to relevant law enforcement? Don't think it's the same as a software vulnerability, especially when it's a EU company (gdpr)