The bureau’s cyber chief blamed a contractor’s failure to apply an available fix for an intrusion that may have exposed sensitive employee information.

The former analyst says supervisors were told not to put things in writing, so many of the directives came in face-to-face meetings.