It's probably been exploited for quite a while already, takes a certain time and threshold until these kinds of things fully bubble up to the public.

People who've been affected might not have noticed or cared enough to say/do something.