They provide data feeds to many third parties, who might themselves be vulnerable, hence the notification.