This is genuine, unfortunately. It's been all over the IT news for around a week.
https://www.theregister.co.uk/2020/03/06/virgin_more_leak_details/
I was only informed by email today: two of my colleagues were informed last week.
The galling thing is that they've screwed up badly, yet all of the action in the email is directed at us, the victims of their incompetence.
Also, once the ICO gets their act together and issues a fine we'll likley end up paying for it again through higher bills.
This may well be the final nail in the coffin for VM, for me.
Disgusted.