It’s not a notice of a vulnerability. For all they know it was an employee abusing access. You don’t leave a skimmer on a pump and politely keep sending emails to corporate waiting for a response. You call the cops and they should shut the pumps off until the skimmers are removed. With the amount of AI security report slop and AI extortion spam out there this is basically a service that only the web host can provide.