Ask HN: I came across customer data exposed, for a company I interviewed?

I interviewed for an e-commerce startup company a month ago, I saw their ad on FB and was browsing their site and came across an API endpoint that was exposing potentially all customer's data, including name, email, phone, and full address.

A little background about the company, they scheduled an interview with me. I was ready for the interview and the guy interviewing me wanted to reschedule the interview 5 mins after the interview time. I agreed to reschedule and had an interview at another time. But they never got back to me about how the interview went. I followed back up with them 2 weeks ago and they said I was not a good fit.

What should I do now? What is the best course of action to inform them about this?