"Taken as a whole, the agency reports outline hundreds of instances of data breaches involving sensitive personal information since January 1, 2003," the report said. "The reports show a wide range of incidents, involving employee carelessness, contractor misconduct, and third-party thefts."

The number of individuals affected in each incident ranges from one to millions, but in many cases the agencies don't know what information was lost or how many individuals potentially could be affected, the report said. Only a few of these incidents have been reported publicly, and it's unclear in many cases whether affected individuals have been notified or whether remedial action has been taken, according to the report.

"Data held by federal agencies remains at risk," the report concluded.