Comment by jussehoo

I received those too, and I ignored them. Some (usually old) sites storage passwords as plain text, and if that kind of database gets hacked, they spam you those black mails, often assuming you use the same password everywhere. As a safety measure, changing the password should be enough, and in the future use throw-away e-mails for shady sites, and two-factor authentication for trustful ones.