Some time ago I discovered a security flaw regarding the password policy of my cellphone provider which basically makes the website, which includes access to personal information and invoices, vulnerable to brute-forcing (in a significantly short amount of time) and DoS. I reported it to their customer support but they didn't really care about. I was contacted by a technician telling me it's not a big deal but they will look into it. Now, months have passed and nothing has changed.
My question is: Are there any best practices how to deal with this situation (especially forcing the company to fix the issue and protect others) without me getting sued? If publishing the issue is an option: Where should I do that? (I don't have a blog, so that's not an option.)