Sometimes you are their customer and have the ability to verify your own data security.

Normally those companies need an intervention from an authority to do something about it though.

Source: Personal experience.