The FSA ID Mistake That Exposed Millions—Here’s How They Did It