Disclose a data breach?

Check the company's website for a privacy statement (data protection notice) and see if they list an email address for data protection matters and notify them that way.

If nothing there, they are unlikely to have a security.txt file on their site, but no harm in checking for one anyway. It might list their disclosure contact details.

https://securitytxt.org/

If all else fails try their info@, hello@ or whatever general contact email they list of their site or through a "Contact us" form.

These are the steps that Troy Hunt of Have I Been Pwned usually carries out, when he gets his hands on a data breach.

If none of the above work, fire a report into the Data Protection Commission. They'll eventually get around to looking into it.

Would love to hear how this played out.

I would disagree that they are not doing the day-to-day stuff. I know of a number of examples of small and medium businesses that have been contacted by the DPC for failing to respond to an individual's request for access or deletion. Those contacts usually scare the bejasyus out of the company, so they generally resolve the situation within the timeframe set by the DPC's contact.

Now I will agree that it will take some time for any kind of initial response from the DPC. They claim a 2 week response time, but it'll be more like 2 months.

I agree

I agree. I know someone who had to complain to the DPC about failure to release a data request by Tusla and St John Ambulance. It got released