Tens of thousands of records with financial data were left in plaintext in a database that wasn't protected with a password.