The email received is a rehash of the linked article, nice find.

>Why not tell all customers at once, especially if payment information was involved?

Answered in the article!

“Q: Am I affected? How will I be notified?

A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“

And also..

"Q: Where can I find the latest updates?

A: The latest updates regarding the incident will be made available on this page.“

..."Updated October 01, 2026 19:29"

For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.

> Q: Am I affected? How will I be notified?

> A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet

That doesn't answer why they are doing it in phases.