An educated guess, based on other posts I've read here:
This is a scam notification, sent from a third-party Web site. The message is a lie, devised by criminals, meant to frighten you into clicking on the notification and taking some action that will harm your interests. Like giving your money to the crooks, or giving them information they can use to commit identity fraud against you later - or even installing remote access software on your computer, the better to let them clean you out.
The crooks have not managed to hack iCloud, and probably don't have the technical skills to even begin to figure out how to try.
The System Preferences / Settings icon is real enough, but the message is not from your Mac. Apparently, some versions of the notification system allow Web sites to supply their own icons (instead of the generic Safari icon). Legitimate sites use this to help you identify their notifications more easily. But here the crooks have used this to send an unauthorized copy of a real system icon in hopes of hoodwinking you.
Some other volunteers who regularly post here may be along soon with detailed instructions on how to turn these notifications OFF for the offending Web sites. I'm running a very old version of macOS and of Safari that does not have this notification feature, so while I have a good idea how things work, I don't have a step by step guide to the specific controls you need to modify.
