Waiting for three years before telling users that their  personal information has been hacked may be worse than the breach itself.