OPM hack was avoidable, says report