In my experience, you find out BONTO! had a security breach via an Ars Technica article published around 4 months after the fact because the data was found on the dark web. Zero correspondence from the company itself except in rare circumstances