Operators failed to let customers know that their accounts had been hacked