An exposed Amazon-hosted server allowed anyone to access reams of customer data without needing a password.