It seems plausible that big organisations might take the contact from an individual as "I haz ur data, omg Haxor!", then call the police. Whereas the approach

It seems plausible that big organisations might take the contact from an individual as "I haz ur data, omg Haxor!", then call the police. Whereas the approach from a local CERT agency is likely to be taken more seriously, acted on more speedily, and possibly result in less blowback on the individual who came across the information and reported it.