Sorry about the namechange - it's all rather delicate.
Dh is an IT contractor and has been working, via a third party, for a large online retailer. This retailer has stored the credit card details of literally hundreds of thousands of customers in an insecure database that is completely open to all and sundry at the company. They have an extremely high staff turnover so anyone could just walk out of there with a CD filled with credit card details (including everything you need, addresses, CVC numbers, the lot).
Dh came across this database early on in his contract and was shocked - even more so when he found his brother's credit card details on there. He pointed out to the company that the data is totally un-secured and they didn't really give a sh*t.
You might wonder why this is a problem as obviously retailers such as Amazon store credit card details - but these are stored very securely and can't be accessed by employees. This company (like most) isn't even allowed to retain the details after the transaction.
Dh's involvement with the company is coming to an end and as they have still not take any action, he wants to blow the whistle on this, as anonymously as possible. Where should he go?