While the breach notification letters might seem out of place almost two years after the incident, they were prompted by new findings while analyzing data stolen during the 2019 security breach.