https://www.techdirt.com/articles/20190818/14503642810/millions-biometric-records-collected-companies-governments-left-exposed-web.shtml

One of the many problems with collecting biometric data is you need to have someplace safe to store it. Sure, you could lock it away in something disconnected from the net, but then it's not much use to the dozens of private companies and government agencies that want access to the data they've collected. So, back on the web it goes, where it can be prodded for weaknesses by security researchers and malicious hackers alike.

We can only hope the security researchers got there first.