My evidence is that I registered on Bittrex using a unique email address that I only used on that service. Now I am getting phishing emails to that email address.

When I contacted Bittrex's support they did not admit to a security incident. They merely claimed that I was getting phishing emails and that I shouldn't click on the link.

(Because I used a unique email address with Bittrex, anyone sending email to that address either has Bittrex's private data, or made a very lucky guess.)

I'm concerned because Bittrex had sensitive information, like bank account numbers and passport images.

Any suggestions about how to move forward?