Fashion retailer Express left customers’ personal data and order details exposed to the internet