Considering the data at risk, the delay in notifying users was too long. That's 15 days in which the hacker was made aware to hastily make use of their stolen data.