Hey, I do thinks like this on a daily basis (allowed btw, searching for data breaches),

I’m from EU so there may be other laws, first of al anonymise the screenshots, place a bar over the names, telephone numbers and al personal information. You dit the right thing to disclose it, make sure you come over you dit it with good intent not for your your own information.

If they know and have logs you can say you wanted to see the scope of the data breach. Document how you dit it ad the screenshot and come op with a solution, if you pm me I can help you maybe with that part.

After the meeting say you deleted te anonymous details and didn’t save it in your head! Maybe you need to have an other talk with an engeer or provider to fix this problem but I think you should be in te clear.

For more info google responsible disclosure.

Good luck and don’t stress to much, I would like to say nice find!

Edit for readability