Hackers stole Estée Lauder staff’s bank and health data. The company took nearly a year to say so.