I always love reading these kinds of security disclosure messages because one day I might have to write one myself. This is an excellent example, so I'll save it here for posterity...
https://about.gitlab.com/2018/03/26/summary-of-limited-gitlab-credentials-exposed/