The company flagged two new incidents as 'critical,' yet did not discover or disclose them until months later.