Sensitive personal details were available on a cloud server to anyone with the correct link. – Source