It’s not clear which leak the data is from. From the articles I read there were two leaks that the data may have come from. One in 2018 and one in 2019.
In either case, it seems like they would have notified users (if at all) when they were alerted to the leak and fixed the vulnerability.. not 2-3 years later.