[sethammons]

I like a sibling comment that suggested a certified letter. You can also reach out to their security team and let them know they are actively sending private information to unintended recipients. Legal and/or security is a good starting point.