First Minister Mark Drakeford found out about a major coronavirus data breach 11 days after his Health Minister Vaughan Gething, according to accounts given in the Senedd by the pair.
Mr Gething said he received a “serious incident alert” on 3 September.
But Mr Drakeford told the Senedd that he learned about it when Public Health Wales informed the public on Monday.
Details relating to 18,000 people who tested positive for the virus had been published on the health body’s site.
The data, including initials, date of birth, geographical area and sex, remained live from 14:00 on 30 August to 09:55 the next morning.
Public Health Wales (PHW) has apologised for the breach.