Serious lapses put Social Security numbers and other private information at risk, whistleblower claimed.