I don't understand your reticence to report their wrong-doings.

If someone is doing something they shouldn't, you have options, including but not limited to:

1. Talking to them in the hope that you can educate them and stop them doing what they're doing
2. Reporting it to your manager/their manager/a security team
3. Doing nothing

Going by your description, it appears that they are willfully breaking company policies. This, for me, is far beyond a small chat. This is reporting time and should have happened as soon as you became aware of it.

How long are you going to consider your options before you find that something serious has happened? How do you know something serious hasn't already happened?

Have you considered that by knowing about this and not reporting it, you are now part of the problem?

Tell someone. Tell your manager that you have suspicions, tell their manager that you have suspicions, use the whistleblowing hotline if you have one, tell the security team. Just tell someone.