Disclose everything over Tor. The kind of scum that sends credit card data over insecure homebrew crypto deserves no mercy.
And yes of course you can also use Tor to contact them anonymously before disclosing.
Once you're in there you can just use the Tor browser to create an email account at any email provider (make sure you give them fake details though) and send your email.