For instance, right now all 70,000,000 of the Facebook users in Vietnam have their information posted online on an open web server. I am not going to post it just yet in the last hope that someone from FB will reach out to me, but the info is their along with their IMEI number, cell phone number, information on what ads they've seen and clicked on, etc. For some users there are absolutely private messages, it appears to be only for Muslims in Vietnam though (so not all nor am I saying all).
Until yesterday, the S3 bucket https://whatsapp-messages.s3.amazonaws.com was open. You can search CNAME records if you have a SecurityTrails subscription, and this bucket belongs to a certain FB contractor. In fairness it could have been something known as "Domain Shadowing" whereby you secretly hack a groups subdomain records for evading firewall purposes, but in that case the argument still stands.
It had over 13,000 pictures from various Latin American police departments that change every few days while I tracked it.
NOTE: FB Security ppl, my email is in my profile.
EDIT: This is a very good paper from Tsinghua University in 2016 on Domain Shadowing, which more people should be aware of. Check your subdomains, and make sure you use the free option in SecurityTrails to do it. Passive DNS checks aren't enough here: https://faculty.sites.uci.edu/zhouli/files/2018/09/ccs17.pdf