Data exposed included users' full names, email addresses, URL requests and authentication tokens