Report to your state's privacy department (if applicable) and your Attorney General. No guarantees, but once it's in regulator hands, you can let them run with it.

https://www.naag.org/find-my-ag/