I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not mine).
I wrote to a service email address but got no response and the site is still on with the same error.
What should I do now? Is there any legal requirement for the company to respond/to do something (we are talking about the German branch of an American company)?