The list was left accessible on an Elasticsearch cluster that had no password on it.

X leaked because of misconfigured elasticsearch is pretty much a meme at this point…