Cardiff's children's chief confirms data leak 2 months after cyber risk was 'escalated'