Looks like Mixpanel is handling this well: they deleted the data, notified affected customers, and then are making sure it can't happen again. +1 for admitting responsibility instead of deflecting or minimizing.
Why would they inform the end user though ? The end user doesn't even know what Mixpanel is and would be confused if they emailed them directly. Informing the clients (BMW, Samsung etc.) is the right thing to do which they did. I'm sure they had to do a postmortem and make sure a fix is in place before informing the clients and urging them to update the SDK.
So that the end users can grasp to which extent their privacy was violated? If a third-party I never heard of, contacted me and told me they got my login details, I would be bloody furious. And that is a good thing if people are enabled to this.
In the words of Nixon they “Earned everything [they] got.”
"What're all these batteries and horses and staples doing coming up in my advertising???"
They did minimize how many people they told. Lol.