The agency said it exposed 2.3m people's details in a “major privacy incident” involving a contractor that set up temporary housing.