This assumes there was a hack. If there wasn't, then there's nothing they can really do. They couldn't have reached out to customers before, they can't say they

This assumes there was a hack. If there wasn't, then there's nothing they can really do. They couldn't have reached out to customers before, they can't say they're looking into it (because there's nothing to look into), etc. It feels to me that a few people got phished, and their accounts are being sold as proof. The rest could just be fake. (Or, there was a hack, and Instacart handled it badly!)