VA faulted in data theft