The exposed database was connected to the internet without a password, exposing GPS coordinates, names, phone numbers, and postal addresses.