In the age of any website getting hacked, take your steps carefully. But then dont make a business of this discovery, but assist. go ahead inform them by phone call, keep logs of your conversation.