It's simple. You had "only" 16 months to fix issue and you did nothing. Did you even try to let your 300k users know what's happening with their websites? -No.

Difficult situation. Good Luck!