By the sounds of it, they probably don't know the full extent of who and what was taken, otherwise they could just email everyone involved and say: "there's bee

By the sounds of it, they probably don't know the full extent of who and what was taken, otherwise they could just email everyone involved and say: "there's been a breach and it affects you" ... or they could contact CC companies.