My money is on a unprotected Elasticsearch server.

I agree that is very likely these days, but the laptop thing has happened before [1]

[1] https://www.scmagazine.com/home/opinions/blogs/the-data-brea...

Press release: "A sophisticated cyberattack has breached our system. Although we assure you that no public data was accessed, we are advising those who have traveled within the last 10 years to assume a new identity."