A major social media platform has admitted that it failed to report a significant data leak that occurred over two years ago, in which the personal information of an estimated 12 million users was accessed by unauthorized parties. The delayed disclosure has infuriated regulators, advocacy groups, and users, and is expected to result in substantial legal and financial consequences.

The breach, which involved the exposure of email addresses, phone numbers, birthdates, and private messaging metadata, was discovered by the company's security team shortly after it occurred. However, internal communications obtained by journalists reveal that executives decided against disclosure, fearing reputational damage and regulatory scrutiny.

"This is a deliberate cover-up, not a mistake," said a regulator leading the investigation. "Companies have a legal and ethical obligation to inform users when their data has been compromised. Choosing not to do so for two years is a serious breach of trust."

The revelation has triggered formal investigations by data protection authorities in multiple countries. Under regulations such as the European Union's General Data Protection Regulation (GDPR), companies are required to report data breaches within 72 hours of discovery. Failure to do so can result in fines of up to 4% of global annual turnover.

The platform's CEO has issued a public apology, acknowledging that the company "fell short of its obligations." Several executives who were involved in the decision not to disclose the breach have since resigned or been placed on administrative leave.