Ask HN: A Big Company was hacked, they won't admit it. What can I do?

A long time ago I submitted a custom e-mail address to a VERY large organisation for an in-store discount. Now, several months later I've begun receiving 419 scams and fake invoice phishing emails.

This is an address that you really can't just guess.. And it's the only address I'm receiving them on.

The company will not admit they've been breached. Nor will they tell me which parties my information has been supplied to.

Just as well I can block all emails being sent to that address now.. The exact reason I set it up this way.

I can confirm with friends who also signed up that they've started receiving the same emails.

Here's the kicker. It's illegal for them not to notify us of a breach in this country (Australia).

What can I do?