While researching manufacturing software online, I found a Chinese automotive factory with their production system completely exposed to the internet. This should NEVER happen - manufacturing execution systems should stay on internal networks only.

Out of curiosity (and 10 years experience with this software), I tried logging in. Default passwords were changed, but there's a forgotten technical service account that admins always overlook. Got right in and could see live production, work orders, operators working - basically could shut down their entire factory.

Now I'm torn. I want to tell them about this massive security hole, but I'm scared to use my real email. Should I make a throwaway email to contact them? What if they think it's spam or get me in trouble somehow?

How do you responsibly disclose something like this while staying anonymous? This is a serious vulnerability that could destroy their business if the wrong person finds it.

TL;DR: Found Chinese factory's production system wide open on the internet, got in easily, want to warn them but don't know how to do it safely.