First thing is you need to be aware that anyway you do go with this could end up with legal action against you from the company. This can happen even to people

First thing is you need to be aware that anyway you do go with this could end up with legal action against you from the company. This can happen even to people with the best intentions or who try to be responsible. Just make sure you are aware and understand the risk. You've already talked to the company, so anonymously releasing the information is out of question, they could probably track it to you. Do they not have any sort of policy on this? Maybe try to talk to their team again but make sure you get it in writing and signed first that you're not going to be held liable, and just make sure you're safe. Maybe even ask a tech-orientated lawyer first? My advice would to just try to be nice and open to the company, but stay firm that this is a major issue. Maybe write up some documents with exactly how you found everything, what it could mean to their company if it got out, and what they could do to fix it. Just really be aware of your safety/risk. If you try to help and they don't want to fix it, don't feel bad or unethical, you've done what you can.