I think this probably falls under responsible disclosure. There are a few steps you should take that have already been mentioned in isolation but should probably be taken as part of a holistic approach to the problem.
The first thing you should do is report the problem to the support team.
Detail the steps to take to replicate the issue (i.e recover password, receive password in plain text) and include information on what this reveals about how they are handling passwords and why this is a bad idea.
I would also include some news stories about simmer issues to this in the past to provide context, for example this one about PlusNet.
I would explain to them that if they have not resolved the issue with x days (90 days seams reasonable to me) you intend to take action.
Tell them what this action is. For example that you believe they are processing credit cards so you intend to report a PCI violation. Explain clearly that if the issue is not resolved you intend to publicly disclose the issue. (Blog post, social media, reporting it the specialised media, ‘shaming’ sites etc.)
A couple things to remember is that even though they are at fault it will take them some time to implement the change, (although doubtful) they may not beware of the issue due to lack of investment and/or skill in the IT team, so act in good faith and give them a reasonable amount of time to make the change.
The second thing you should do is follow through with above.
The issue here of course is that this very question has skipped directly to public disclosure.
Given that, I would include a link to this question, as seeing a bunch of security professionals discussing the issue will no doubt sharping the sysadmin’s mind (and if it doesn’t then Western Digital should be looking for a new sysadmin)