When MongoHQ got compromised, I received emails for several SaaS providers (such as intercom.io) that I've used basically telling me that my data may have been compromised. Here's a clip from that email:

"We made a massive effort to ensure our system was secure. We worked with industry-leading security firms to audit our software. They graded us excellently. We’re frustrated and upset to have had our record damaged by a third party, and we’re extremely sorry that this may have impacted you."

If my data was isolated in a single tenant application, this would have been less likely.