Ask HN: How do you inform an organization of exposed sensitive data?

If you came across a Google result which brought you to a Google Sheets page which had login credentials to multiple websites; how would you go about ethically informing the organization of their compromised information?