Following a server migration, an internal system became accessible from the internet. An unauthorized individual accessed customer data, including passports and driver’s licenses in some cases.