Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.
Telling small organisations to outsource is not a compromise position. It is the only realistic path to any capability at all.