There is no scenario where the phrase “stored and accessed online” should not be accompanied by the phrase “protected by or behind a firewall”.  This potential breach is yet another reminder that we all have a responsibility to protect and safeguard individual and customer data, especially in an online environment.  There really are no exceptions.

https://www.tripwire.com/state-of-security/security-data-protection/hitherto-unknown-marketing-firm-exposed-hundreds-of-millions-of-americans-data/