Second health provider, Canopy Health, hit in major cyber attack

But it's taken six months to notify some patients or the public.