Cathay Pacific Airways has been criticized for failing to disclose a breach involving the personal data of up to 9.4 million customers until months after it was found.