The best next step here would be to ask people for recommendations for a lawyer to pursue the case. What you'll learn is that different lawyers handle different kinds of things; most lawyers do things like contract review or mergers and not litigation.
If you have any kind of rapport with any lawyer, they should be able to refer you to someone.
When you talk to the lawyer, you should make it clear that your interest in the case is in stopping ongoing fraud and abuse, and not in getting any kind of payout, because otherwise lawyers will probably be at pains to tell you how your case isn't lucrative. But of course that's not the point!
There are a couple really smart lawyers (and hackers with legal training) on HN who might be able to recommend people to talk to.
From my very limited experiences with law enforcement: they are overwhelmed and unlikely to pursue a case in which no clear damages occurred. But the same thing is not true of civil litigators!