> If this was in Costa Rica the appropiate way was to contact PRODHAB about the leak of personal information and Costa Rica CSIRT ( csirt@micitt.go.cr ).

They did. It's in the article. Search for 'CSIRT'. It's one of the key points of the story.