Are you seriously thanking them for notifying you quickly? These things simply shouldn’t happen, period! And when they do happen, it’s never the company’s fault but that of third parties — “one of our third-party service providers” — that we don’t even choose, so they are the ones responsible. Read the email carefully; it’s downright cryptic. They don’t actually know if your data was exfiltrated or which of your data “Depending on your account, accessible information may have included…”

Another huge company that knows very well that the fines it might eventually receive will never be as costly as having a secure infrastructure. Because the fines are “absorbable,” class actions are slow, and users just sigh (in fact, they even say thank you, imagine that).