Note that in the EU this would be a pretty bad violation of GDPR, so going to your local branch of government responsible for GDPR enforcement (e.g. the Information Commissioner's Office[1] in the UK) would be another good avenue.

[1] https://ico.org.uk/