On the contrary, the complaint is that they did not. They specifically chose not to alert those affected.

But also... you do understand that we're talking about analogous but not identical laws here right? The context of this entire thread is laws that specifically require notifying people of data breaches, and not laws that require recalling bad food.