Recently, our company (Dutch) got acquired by a bigger company (Indian) and consequently, our company had to switch over to the acquirer's IT ecosystem. Some parts of the acquirer's system are badly outdated and do not follow best practices for security, creating vulnerabilities.
Despite expressing our serious concerns regarding the risks these limitations bring and the likely security issues and abuses they cause, the team responsible for maintaining these systems (based in India) have not adequately remedied these problems.
Recently I found a major vulnerability that could seriously compromise corporate systems, including my own personal data as stored in these systems.
I have all the proof needed to prove the vulnerability, but given how the bigger corporate treated our last request, what would be rational thing to do? Obviously, quitting doesn't solve any problems, as my data and information are staying in their systems for at least two years after my termination.
Edit: I must emphasise that I have NOT broken in the system. There are other ways to prove the existence of this vulnerability.