Security vendor slams supplier for delayed notice after staff data exposed