Government is hit by 9,000 security breaches a year - but reporting them remains chaotic