NHS supplier that leaked employee info fell victim to fiddly access controls that can leave databases dangling online ...