As part of efforts launched after the breach -- which left 26.5 million veterans and active-duty military personnel concerned that their personal data had been exposed -- Nicholson ordered that all agency laptops be turned in for a review. He wanted to ensure that security controls such as updated anti-virus tools and encryption support were present.

But a court injunction stemming from a lawsuit has so far prevented the agency from moving ahead with needed changes to the laptops, Nicholson said Thursday at a hearing before the House Committee on Veterans' Affairs.

"We understand from [the VA's] general counsel that there is an injunction on doing anything with the laptops," Nicholson said.

VA General Counsel Tim McLain, who also testified at the hearing, said that three class-action lawsuits have been filed against the agency so far because of the breach, which occurred when a laptop with data on military personnel was stolen last month. The laptop was recovered this week and none of the data appears to have been tampered with or exposed.

Lawyers in one of the cases objected to the VA's plans to update laptop security in cases where adequate protections were not present, he said. "There was a strong letter saying that this would be destroying evidence or tampering with evidence," McLain said. So until the courts rule on the issue, the VA's plans to implement new security measures on laptops are on hold. "It is a delay, not a moratorium," McLain said.