This looks like responsible disclosure of a partial breach to me. It’s required under the GDPR for example and the company likely already reported it to the inf

This looks like responsible disclosure of a partial breach to me. It’s required under the GDPR for example and the company likely already reported it to the information commissioners office of its equivalent. If you buy that this can happen to every company, telling every customer whether it effects them or not is a great way of wrong sizing a problem, introducing disproportionate uncertainty and losing customers. IMO, so far, this looks responsible.