Is there an email notifying all users of the incident and a separate email notifying those affected, or just one?

Many companies seem to use intentionally vague wording to suggest you might not have to worry.