38 million records exposed online—including contact-tracing info