Philadelphia police said the tip was "flagged as spam", but criticised the tech company for taking more than two months to detect and report the breach.