The data breach occurred earlier this year, though the company chose not make it public or inform authorities because it did not consider the incident a threat to national security