Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.