I'm on Lenovo's mailing list and haven't seen a similar statement in my inbox with remedial instructions.
I was only half-lucky with Superfish. I bought my Y50 before Xmas and removed Superfish and all other non-essential software but didn't know about the certificate, which I deleted today.
Sadly, I don't think the typical non-technical Lenovo user is even going to find out about this or know how to fix it.