The old answer I've heard is to look up what their address and room number is in WHOIS and walk over or pick up the phone!

But to be fair, that small web situation was before my time as well. Afaik that's still the directory to look in though. Complaining to third parties behind these owners' backs is a bit of a dick move, though I can understand the reasoning since most people are not aware of the repercussions (see my other replies in this thread, e.g. https://news.ycombinator.com/item?id=50397828)

Google already does that, and they warn users about malicious sites. The question is: are these sites already flagged by google?

HIBP works fine when you check it every once in a while, but as a mechanism to reach site owners about urgent issues, they'd all have to subscribe to such a central reporting place. Not sure what the advantage is of subscribing to "has my site been pwned" as compared to just having a /security.txt, working WHOIS record, obvious contact page linked from the homepage... lots of ways already

Edit: I could see the benefit if they do vetting of the message though. Like if one person vets the message and then it makes it into 15000 inboxes is better than having to deal with 15000 antispam mechanisms. Maybe there's something to this after all. Or if email providers would act upon spam better and we block the ones that don't, maybe we could just not have spam in the first place. Idk why this is so hard in the first place

Whois still works. Try it:

    > whois ycombinator.com
    Domain Name: ycombinator.com
    [snip]
    Admin Name: REDACTED FOR PRIVACY
    [snip]
    Admin Email: 1bd279b6ad24fb60b2e200db8f486c3f-2545852@contact.gandi.net

Gandi.net will get the message through to the person who would have been registered as the admin contact.

It's still possible to use whois data. Most of the time it'll be an abuse@ email address from a provider and they can forward the message to the real admin, or they could directly block the website if you explain the issue.

The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided to spam people, we would probably still have public contact info.

whois was effectively dead well before GDPR -- most people used registration privacy services to hide their mailing address, phone number, etc.