I mean, it's hardly a phish. It doesn't try to directly link to an action page, and the requested actions are somewhere between "FYI" and "Hey, change your password and strengthen your security".

Not that I distrust you or am asking you to make a change, but it would help if they were to at least post the mailchimp link on their social media.