This seems a hardcore case of moral damage worth at least some hundreds thousands dollars in a settlement or even suing some millions dollars out of them, doesn't it? Perhaps you should at least ask a lawyer before just humbly reporting the bug to them and forgetting.