I received this email at 10:42pm PST.

At the time, I could not find the disclosure on their website.

I'm glad they disclosed shortly after discovery, but not publishing it on their site is an odd choice.