The overwhelming majority of California’s state agencies are ill-prepared to defend against cyberattacks, according to the state auditor, putting Social Security numbers, health records, and income tax information at risk for millions of Californians.

In a report issued on Tuesday, state auditor Elaine Howle said 73 of 77 state agencies that her department reviewed had not achieved compliance with cybersecurity standards. The California Department of Technology, responsible for ensuring the integrity of the state’s information systems, “does not provide adequate oversight or guidance to reporting entities,” Howle wrote.