In my experience, you find out BONTO! had a security breach via an Ars Technica article published around 4 months after the fact because the data was found on the dark web. Zero correspondence from the company itself except in rare circumstances

Because TurboTax lobbied to change the narrative to “we already have private market solutions for tax, therefore the government hosting a no-cost option is actually wasteful and bad for the budget”