Why notifiy? Victims got notified everyday with many spam-sms. Thanks Facebook!
From my point of view it is their obligation to notify all the affected users. It's morally the right thing to do, and legally, well, I don't know, but maybe the GDPR says that yes, that it's their obligation to do so.
And with notification I mean to send a notification email, since I haven't logged in for months and don't intend to this year.
> whilst each record included phone, only 2.5 million contained an email address