If YC’s processing of information fails to comply with the laws governing YC, a business operating in California, then certainly a report of mishandling is presumably of interest to California functionaries. Whether or not that is the case is something you’d have to evaluate using California law and a direct knowledge of the PII or PII-alike in question.