A hacker exposed millions of residents and businesses to identity theft in September largely because the Revenue Department did not encrypt personal data including Social Security and bank account numbers and failed to block access to them with layers of security.