First Minister Mark Drakeford found out about a major coronavirus data breach 11 days after his Health Minister Vaughan Gething, according to accounts given in the Senedd by the pair.
Mr Gething said he received a “serious incident alert” on 3 September.
But Mr Drakeford told the Senedd that he learned about it when Public Health Wales informed the public on Monday.
Details relating to 18,000 people who tested positive for the virus had been published on the health body’s site.
The data, including initials, date of birth, geographical area and sex, remained live from 14:00 on 30 August to 09:55 the next morning.
Public Health Wales (PHW) has apologised for the breach.
In the Senedd, Mr Drakeford said he did not know when officials and ministers other than himself were informed of the breach.
Mr Gething said it is not thought anyone had “come to harm” from the release.
Welsh Tory group leader Paul Davies called for the first minister to apologise. Mr Drakeford replied: “I learned of this data breach yesterday [Monday], and I learned of it as a result of Public Health Wales’ statement.”
“It is a serious matter when data regulations are not properly observed.”
He said PHW had been right to apologise to those concerned.
“Thankfully… the breach lasted for less than a day, and the initial inquiries suggest that no harm has been done as a result, but that is a matter of luck rather than anything else.”
Mr Drakeford said it was right that PHW had instituted an inquiry and informed the information commissioner.
‘I know when I was informed’
Pressed by Tory Senedd member Andrew RT Davies on when the Welsh Government was informed and which minister was the first to be told, Mr Drakeford said: “I know when I was informed.
“I don’t know the answer to those other questions nor would I expect to know them just standing up here in the chamber.”
A Welsh Government spokesman confirmed, however, that Mr Gething was told about the data breach on 3 September.
This was reiterated by Vaughan Gething, who told Senedd members he was informed “with a serious incident alert on 3 September”, after officials were told on 2 September.
“That is entirely normal,” he said.
“We don’t believe anyone has come to harm. But it is a serious breach and it needs to be treated seriously.
“That’s why there is an independent investigation,” he said, promising a publicly published report.