The breach was announced in September, but notices to potential victims went out in December. The company said this was due ...