You have a few options but it's first and foremost important to understand laws related to "hacking" in your country. Your first option is simply to let it go.

You have a few options but it's first and foremost important to understand laws related to "hacking" in your country. Your first option is simply to let it go. It might not be worth your time, energy and risk to pursue this. Certainly if the vulnerabilities are not high risk. You already did the right thing by notifying them. It's the company choice to accept the risk of not fixing the vulnerabilities. You can file the finding with your local CERT, they might be able/helpful to coordinate. You can go full disclosure with it, if you accept the risk the company might sue you. Even if you're in the right, it might cost you a lot of time, money and anxiety before the court says you are. See option 1. Notification to the authority responsible for enforcing GDPR or local privacy authority might be worthwhile, it depends. Also, what kind of PII are we talking about?