If they have a bug bounty programm, look at it.

Also try to contact the $company's domain Admin (who.is e.x. give it to you) or, if availabel, the Network Abuse Team for further help to get in contact.