> There have been a few examples of this on HN (none of which I can currently find, unfortunately) - person sends appropriately written letter to legal, legal understands that this is not worth the time and the best resolution for the company is to comply, company complies.

This is a fairly good post on that; the topic is a bit different, but the advice is the same (from "Presenting like a professional" header on): https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...