FEMA put 2.3M survivors at risk of fraud and identity theft by provided a housing contractor with their personal information.