As suggested by others, I think haveibeenpwned is the most likely to help users as much as possible. From a personal liability PoV reporting this to some broke

As suggested by others, I think haveibeenpwned is the most likely to help users as much as possible. From a personal liability PoV reporting this to some brokerages with affected accounts is an alternative that only contacts organisations with direct legitimate interest, specific obligations and immunity from a lot of the liability an individual researcher has.