[schoen]

You could also check https://iapp.org/resources/article/state-data-breach-notific... and report it to state authorities in the relevant states (whichever you think those are). These notifications are usually supposed to be made by the company responsible for the data breach, but I imagine some of the state authorities would be interested to get a third-party report too.