That's according to an official report from the VA's Office of the Inspector General (OIG) released this week. The report also identified process and policy failures, a lack of supervisory oversight and personal squabbles that exacerbated the incident -- and the agency's response to it.

Personal information, including names and Social Security numbers, about 26.5 million veterans was exposed when a laptop and external hard disk containing the data were stolen May 3. Both pieces of hardware were recovered last month by the FBI, which said the data appears to have been untouched.

In a statement responding to the report by Inspector General George Opfer, VA Secretary Jim Nicholson said he fully concurs with the recommendations and is committed to making the VA a "gold standard" for information security among government agencies.

But Bruce Brody, a former chief information security officer at the agency, called the findings underwhelming.

"It points fingers at all the symptoms instead of all the underlying causes," Brody said. A lot of the problems at the VA have to do with systemic cultural issues and an environment in which the information technology office and the security office have traditionally had far too little authority to be really effective, he said.