Sensitive data on 3.3 million US citizens has been breached, but the company took two months to discover the cyber attack.