The original reports from the us government stated that only 40 organizations got a secondary payload .. now they've upped it to 250.

That's a 5x increase, and is pretty substantial, especially because each of these organizations are generally large, important, and were likely specially targeted for a reason.

It's also important to get this message out because so many people are out there thinking that since they weren't on the initial list, that they are safe.

That is not the case. The attack was much wider than reported, and this is a huge deal because it means there are likely still breaches that have not been found yet.