The federal agency took blame for the incident, saying the addresses were “inadvertently exposed as we transitioned to a new IT system.”