There is - not letting it be - raising awareness and contributing to prevention of a normalization of such things. If everyone would hold "let sleeping dogs lie"/"not my circus, not my monkeys" attitude it would gradually become a norm and this benefits no one (but possibly bad actors).
However, exercising caution never hurts, so it shouldn't be a bad idea to reach out anonymously and explicitly state that you have nothing to do with the issue at hand and merely an observer who had noticed its existence. Doing so through a trusted third party who are experienced (many names in comments already) with handling such situations is probably the best approach.
It already is a norm. Companies and organizations leak data constantly and there are near zero repercussions. A best a tiny fine that's utterly irrelevant to their fiscal position. An hour of earnings.
Meanwhile individuals who are trying to do good more often than not are accused of hacking, blackmailing, CFAA violations, etc and may end up with serious individual repercussions, fines, fees, or jail.
It's absolutely not worth it on an individual basis. I cannot stress this enough.
There is - not letting it be - raising awareness and contributing to prevention of a normalization of such things. If everyone would hold "let sleeping dogs lie"/"not my circus, not my monkeys" attitude it would gradually become a norm and this benefits no one (but possibly bad actors).
However, exercising caution never hurts, so it shouldn't be a bad idea to reach out anonymously and explicitly state that you have nothing to do with the issue at hand and merely an observer who had noticed its existence. Doing so through a trusted third party who are experienced (many names in comments already) with handling such situations is probably the best approach.