Credit Karma's Identity Monitoring service routinely checks to see if your email has been in a data breach.
It looks like your personal data may have been compromised, not at Credit Karma, but in at least one data breach affecting another company.