Canva Security Incident

I never got an email from them. Blaming users for having incorrect email addresses is a cop out. It sounds like there are very many people they didn't notify. Did they actually notify anyone before HIBP?