UA discovered the security breach in April.  But they wait until September to tell the 5400 people who's identity information may have been misused that there could be a problem?  4 to 5 months to let people know their confidential data was breached?  Not good UA, not good.  It should have been 4-5 days.