I'm on one of their MVNOs, but I haven't gotten any email, and the CoR (customer of record) is probably the MVNO, not me, so I guess I'm save. Besides, I never use a password at more than one place, so even if they got the password for the account, it's not going to do them any good. (And if they get enough information to seal my identity - there are enough precedents to make TMO liable for any monetary damages I suffer.)
What are they going to do about it? Probably not a thing. Security is definitely not Job 1.
But thanks for the info.