Well done. Everyone who knows and everyone who ought to have known beats responsibility to take action. And that's the most anyone could ask of you.I shoot of an email to the customer and their I&E contract company who did write the code telling them they may want to take a look at this and I'll be fine.
I was in a situation where code was clearly violated and there was risk to people and property so I chose to contact only the contractor and requested they send me a letter stating that they have been informed and that they will take the necessary steps. I made it clear that if I do not get that confirmation I would have an obligation to inform the customer. A few days later I got a letter from their lawyer and of course I informed the customer. A couple of years later the exact situation happened again on another site so I was way more careful in my approach and wording but that didn't help either and long story short I informed the customer and we are likely to be tied up in court of liable (defamation) for the next few years.