The organization doesn't keep contact data - and therefore can't notify the victims.

source https://www.techradar.com/pro/security/new-york-blood-center-data-breach-sees-200-000-affected-and-you-might-not-even-know-youve-been-hit