A database with 3.5 million records was exposed, with no password protection or encryption.