You should send them a detailed email about it. Be as detailed as possible without doing anything illegal. Then wash your hands of it. If they don't reply, it's

You should send them a detailed email about it. Be as detailed as possible without doing anything illegal. Then wash your hands of it. If they don't reply, it's not your problem. Also, notify any companies that you know use the service. They may have some requests to make of the compromised company, as well.