A property tracking and return service supporting multiple airports had nearly 1M records exposed.