FCA hacking risk kept from regulators for 18 months