Give them a deadline to take action and make clear that you will publish details if no action has been taken until then. If they threaten you, contact a few we

Give them a deadline to take action and make clear that you will publish details if no action has been taken until then. If they threaten you, contact a few well-reputed security research companies and ask them if they want to handle that case for you. They have experience dealing with such situations and a name that will make every company think twice about threatening them with lawyers.