GitHub waited 3 months to notify about potential compromise
They explained it themselves - there's no evidence of abuse/exploitation.
They literally have no legal requirement to even tell you as much as they did.
You should be commending them for filling you in at all.