The company identified the breach on February 28, 2025, but only made an official announcement four days later, on March 4, fueling speculation about an intentional cover-up.