What's surprising about it? I've been receiving "ACTION REQUIRED" emails from them for years that do not actually require action, I receive them simply because I haven't logged in. Mint isn't as different from any of the other unsurprising email-leakers GP mentions as their reputation might otherwise lead one to believe.