It was also my experience that it takes GitHub several months to fix issues and inform compromised users.