Mark Drakeford says he only learned of a data breach involving 18,000 people on Monday.