That's a phishing email and for sure not from Metamask. They normally get your email from some crypto-related service database leak, in my case at least.
It’s very creepy and scary to see the breach notice side-by-side with these scumbags’ fresh phishing attempt. The people behind these sort of attacks need to be hunted down and brought to justice.