The victims affected by the data breach were not told for nearly two years.