Leading data security firm leaves own server unsecured