Comment by toomuchtodo

Report to your state's privacy department (if applicable) and your Attorney General. No guarantees, but once it's in regulator hands, you can let them run with it.

https://www.naag.org/find-my-ag/