38M Records Were Exposed Online —Including Contact-Tracing Info