Contact a known and trusted security researcher who can verify to the world that you did what you said you did, so everyone else can have as much time as possible to figure out exactly how fucked they are. Doing nothing isn’t an option; once someone figures something like that out, it signifies that conditions were ripe for the discovery to be made, and it’s only a matter of time before it’s discovered again independently.

Also fairly reasonable to assume it has already been done by someone who had a motive to break it and is keeping quiet.