You may be on really thin ice if you disclose anything. You may get into real trouble for that.
There is a reason for companies having rigorous agreements between each other when pentesting is contracted. The pentesting company need all the protection they can get. Disclosing information you should not can and will get you sued or prosecuted.
Lets say you go to the marketing guy's boss. The boss clamps down on the marketing guy. The marketing guy begins to cover his ass. He may persuade the boss that in order for you to have this information you must have done something illegal, or similar. Even if you will eventually win, you might be in court for a long time.
If they don't want to take it seriously at first approach, pressuring them to taking it seriously will most likely get you into trouble.
For your sake drop it.
EDIT: Furthermore, if the original agreement for the security audit includes specific people you only may inform, informing other in the same company, not included in the agreement, might get you into trouble.
