The Veterans Affairs Department has ignored warnings, and has weak management and lax rules, when it comes to safeguarding personal information on military personnel. That is according to testimony given to Congress by the Government Accountability Office and the VA inspector general.

Both the GAO and the VA's inspector general reviewed VA information security following the theft of 26.5 million military personnel's private data last month. Reportedly, that information remains at risk because of weak security controls that have not yet been fixed.

Investigators found that the VA routinely failed to control and monitor employee access to private information, did not restrict users to "need-to-know" data and often waited too long to terminate accounts when an employee quit or was fired.

They also said the VA does not maintain a clear chain of command when it comes to enforcing security, and stressed that the agency will need stronger leadership under VA Secretary Jim Nicholson to force reform after five years of repeated warnings about security.