US disaster relief agency exposed private data of 2.3m survivors