Companies have to inform affected individuals of data breaches, especially when HIPAA gets involved. Brokers have to inform clients of transaction errors. Auto manufacturers have to inform owners of recalls. Retirement funds have to inform plan participants of lawsuits involving those funds.

You don't even have to invoke the idea that Meta is big enough to be regulated as a public utility for this to have broad precedent in favor of forcing a malicious actor to inform its victims that they might be entitled to a small fraction of their losses in compensation.