Identity theft protection service accidentally exposes identities