For CX to disclose this six months later is unforgivable. They say the took immediate action, but immediate action requires you to notify those who could be affected. That way, THEY can take immediate action to limit damage/protect themselves. By delaying this six months, the thieves could have done incalculable damage to up to 9M customers by now.
The management team at CX are such irresponsible liars. I hope CX gets fined/sued appropriately for such casual disregard of their customers.