The app let its users know about the fraudulent attempt, which could have impacted its more than 2 billion accounts.