They've admitted to at least five years.

See 1:58:45 [1] when Feinstein confirms with Alexander.

[1] http://www.c-spanvideo.org/program/CybersecurityThreats