Or you can use something like Squarespace or Wix and have a fully functioning website with everything you need in a few hours and start monetizing your views with ads. Both start at $16 a month so it’s a larger hill to climb sure but you get custom branding and don’t have to deal with the baggage of a Medium page (largely that it’s considered in many circles an untrustworthy source for pretty much any topic mainly because of how easy and barrier free it is to write there. They also have a pretty well established history of working to screw over contributors to profit off of your work including you automatically giving a full license to medium for everything you post).
If all you want is a newsletter though without a webpage to back it you can setup something in mailchimp with a custom domain (.coms start at about $10 from cloudflare). Again an hour or so of reading and configuring and you’re on your way, with an Adsense account you can even embed inline ads to your newsletter.
The reality is they may not know exactly what was obtained, but they do know it wasn’t anything they don’t collect (like DOB, SSN, etc listed in the message). Instead of looking at this purely as a CYA message, instead looking at it as informing you as soon as they had any idea your information may have been impacted instead of waiting weeks/months to inform you. Don’t let perfect be the enemy of good.