A security lapse left millions of mortgage records exposed online without proper data protections, according to security researchers.