The users’ email addresses and encrypted passwords were posted on a publicly accessible server for approximately three months.