How best to report website data breach?

I discovered a US website that claims to have gone out of business but exposes personal info (health insurance claim forms) of many individuals across multiple cities in a specific state.