Nearly a million passports and photo IDs were left unprotected on the public internet