A vendor exposed the records, which were accessible with no password or other authentication, likely because of a cloud-storage misconfiguration.
Source: threatpost.com