Data vulnerable to attack, Auditor-General warns