It's astonishing that somewhere out in the modern world there's an api that returns personally identifiable information without requiring any sort of authentication.

What I find absurd is that the company hasn't done anything about it. Even if they don't care/know about security they must at least care for bad PR...

But with all of that in mind, I don't know what's the best way to fight these clueless behemoths. You disclose and thousands or even millions of people will be compromised. You don't and those same people could be compromised but no one will know because the attacker(s) will just continue to siphon information quietly.

They should be waterboarded for making a responsible individual have to choose.

For the record, I approve of this disclosure. Better to know the evil than let it go on unnoticed.