The ObamaCare health exchange in Colorado faced “numerous weaknesses” and had “inadequate security settings,” leaving the personal information of enrollees vulnerable, according to a new audit.

The inspector general for the Department of Health and Human Services publicly released its review of Connect for Health Colorado on Wednesday, revealing the exchange had inadequate security measures in place for more than a year.

The report, which reviewed information security controls as of November 2014, did not go into specifics of Connect for Health Colorado’s vulnerabilities because of the “sensitive nature of the information.”