Legal responsibility? Probably not. Ethical responsibility? I think so. Think about if, say, Conde Nast got hacked and login information was leaked from all of their servers. What would I expect from Ars Technica, Wired, Reddit, etc? A link to a Conde Nast page with one unified statement, closing with something like "We at Ars and Conde Nast apologize...", "We at Wired and Conde Nast..." etc.

Even if Blue Toad wants to be invisible to end users, it's gone a little beyond that. Legally they only have to follow the fairly open-ended PII laws that are in place (I believe California is the only state to require they notify users of a breech), but ethically I believe their responsibility falls a little beyond that line.