Apple failed to disclose security incident affecting 128 million users in 2015