Contact their security team. They should have contact details on their website. Provide links to the data. Do not copy/send any of the data.