The best way to get a company to do anything is through public disclosure, however it is reasonable to reach out to them first, anonymously (so that they don't sue you or kill you), and hope that they are descent people too.
You also broke the guideline asking people not to do the "did you read" thing. It would be good if you'd (re-)read https://news.ycombinator.com/newsguidelines.html and follow them when commenting here.
...
Turtles all the way down.