They left all data on an unsecured system on the internet, the description sounds like the classic elastic search instance found by shodan case. Everything is spun as „bad bad hacker“ when in reality it was blatant incompetence and negligence. The real culprits get away, no charges are being filed. The government entity that is responsible for putting the data on the internet is calling this „common practice „.