Thousands of sensitive event records potentially leaked via misconfigured EventBuilder app