Small businesses may have had info exposed on SBA portal