How best to report website data breach?

[dcassett]

I discovered a US website that claims to have gone out of business but exposes personal info (health insurance claim forms) of many individuals across multiple cities in a specific state.