It ended up being several of our clients.  We were instructed to do this even though no breach could be found on our end.  If you have more than a "few" people, it may be worth reaching out to your Practitioner Liaison for recommendations.  https://www.irs.gov/businesses/small-businesses-self-employed/stakeholder-liaison-local-contacts.

The 14039 and 8948 are exactly what you need to do, regardless.  Hope this helps!