As stated in the post, I contacted the listed email exactly one year ago. I did not contact law enforcement — I did not consider it to be my place

Edit: and I’m not sure standard disclosure even applies. I’m just talking about IOCs, not the actual attack vector (which I do not know)