Law Firm Accused of Waiting More Than a Year to Inform Affected Parties About Data Breach