There are 1+ million anonymous FTP servers on the Internet (https://www.shodan.io/report/OY7YoHou) and it's usually difficult to determine who the owner is. I haven't yet found a good way of notifying users, the best bet is to send the data to the respective ISP or CERT and hope for the best. On a related note: there needs to be way more attention on NAS devices. Many of them are connected to the Internet, poorly secured and in the process exposing huge amounts of personal data (not just through FTP).