From the email:

We value transparency and wanted to notify you of an issue affecting your account.

My guess is they sent it to users with pipelines that have env vars. It's funny since this sentence demonstrates they don't value transparency by not telling the other users more information about the hack.

They updated Heroku Status but surprisingly failed to mention anything about CI or pipelines.