“The list was left accessible on an Elasticsearch cluster that had no password on it.”
Names, passport numbers and no-fly flags for 1.9 million people sat on an open server. Search engines Censys and ZoomEye had already indexed it. People on this list can’t see it, can’t challenge it and often don’t know they’re on it. Anyone with a browser could.