Logonids

Strictly speaking this is not the right place for this post but I don't know where else to ask. Whilst idly browsing the web my daughter came across a conventional commercial site that had, tucked away in a corner as it were, a very long list of logonids and passwords, including her own. It's clear that this can only be used for nefarious purposes. What can I do about this? Who can I report it to?