96 GB of pure credential data were exposed. But who was collecting them in the first place?