I got this email too, which I found to be really lacking in detail. I asked for more info and will post their response if its applicable.

There's literally no way my password was brute forced unless the adversary built a quantum computer, so I think this indicates that GitHub was attacked as opposed to the users directly.