. . .  but waited
another seven (7)
months before telling
users that their data
may have been stolen.