Holes in the Department of Energy’s security system leave the personal information of thousands of past and present federal employees, contractors and their dependents vulnerable to cyberattacks, according to a government watchdog.

Outdated software and lack of attention to ongoing problems cause many of the department’s key programs to operate at a “higher-than-necessary level of risk,” the inspector general said in an unclassified version of the report made public Monday.