The company flagged two new incidents as “critical,” yet did not discover or disclose them until months later.