and based on the custom email address I used only with Working Assets' "Act for Change" email notice service, it is either coming from them or coming from whoever breached their system, so either way it validates the message.

Note that unlike scams, the message recommends that people change their passwords... and the URL (if any) embedded is real.