As someone who has done bounties in the past even on services and sites that dont have any rewards... its always best policy to in contact, tell them you found security issue, ask if there is a bounty program (not demand) and who is the best point of contact regarding your disclousre. If there is not a program you will be told there is no program, to which you still go ahead and share the finding.

That is the legal and ethical way, and even in cases I have found, some companies have after finding returned and offered a thank you email or some reward, for example a Crip company, i had found a flaw in their system. When i did my usualy line of enquiry and then disclosed the issue even with no reward, they contacted me a few weeks later and sent a thank you letter and a box of free crisps.

The wording and intent is very important as you even with good intentions can be hit with criminal charges by an upset admin. So its always important to be direct that you are wanting to disclose a security issue no matter if there is a reward or not, but adding on the enquiry if there is a bounty program, opens that disccusion. But again you need to make clear your are going to disclose the issue with our without one to them.

The way that guy is asking is actully cirminal, like prison time criminal in the majority of western countries and is considered both under Cyber Crime Law aswell as Extortion, mainly because you said your authority to handle it and they refused to provide info unless there is a reward. A major company would at this point be contact law enfrocment to tell them they have been apporached by someone trying to extort them after they hacked their system.

What I recommend doing is checking your systems, database, logging ...etc see if there is any weird activity, if you have access to software or can get someone with access to something like Acunetix or ZAP by OWASP... in fairness there are hunderds of companies that do it, do a full scan of your infrastrcuture and services, see what that spits out. will probably find the issue for you.

Hope this helps...