Why are 1.8M Apria patients just now being notified of a 2021 data breach?

Apria Healthcare has informed over 1.8 million patients and employees that their personal, medical, and financial data may have been accessed during two hacking incidents in 2019 and 2021. The delay in notification is under scrutiny as it extends beyond specified time limits. The firm believes the hack was intended to obtain funds rather than personal information, and no evidence of money being taken has been found. The exposed data varied between patients, but all affected will receive identity protection services.