I've never been in this situation, but this seems like a good option--reach out to someone like Troy Hunt of Have I Been Pwned or a tech journalist who does security related content(maybe someone at Arstechnica?). They probably know how to raise awareness in a way that reduces their personal liability.