[anonymouskimmer]

First I wrote: I would try reporting it to the company, maybe also the FBI or FTC

Response was: Please do not ever communicate directly with anyone from a federal law enforcement agency. Only talk to them through an attorney. They are most definitely not on your side.

Then I wrote in response: The guy is from Canada.

So all three of your guesses are wrong. I'm stating that a Canadian has much less to worry about (compared to a US citizen) when contacting a US law enforcement agency about a compromise in the security of a US company that impacts multiple US states.