Back in February, well over 90 days ago, I reported a vulnerability to a service that is leaking highly sensitive data, such as passport id, full name, date of birth and medical data. After that I have sent a few more reminders about the leakage, but it still hasn't been fixed. What are the best next steps I can take to get this fixed?
I'm aware of responsible disclosure and have found this question which seems similar. But I believe this situation is somewhat different because of the following reasons:
- The data that is being leaked is highly sensitive, and very easy to find. Once I disclose the vulnerability publicly, the medical data from a couple million users is up for grabs.
- The data seems to come from mostly underdeveloped countries, contacting a data protection authority doesn't seem like an option since the data doesn't come from citizens from a single country.
- Considering how simple the exploit is, and how long this has been an issue, I'm not convinced disclosing the vulnerability publicly will make them fix it. The responses I got from them aren't too promising either.
The offending service is acting as a third party for several smaller companies. So this service is leaking the data on behalf of these smaller companies. One thing I can think of is to contact these smaller companies instead. But to be honest, they don't seem to care much about the data of their users either. So if anyone has any better ideas that'd be much appreciated.