So. We have personal data on millions of veterans in a laptop computer. It's stolen in a routine burglary. The chance that either the thief or the fence knows they have a gold mine of data: pretty small. Eventually, some user may stumble on this data. Chance that this user, this purchaser of a hot laptop, will have the know-how and mindset for massive identity theft, or for marketing the personal data: hard to determine.
If I had to decide whether to alert millions of veterans, giving them a chance to protect themselves but greatly increasing the chance that some bad guy would know what s/he was sitting on -- it wouldn't be an easy call, and I probably wouldn't make it overnight.
So maybe we should cut the VA some slack on this one.