I might be misunderstanding you, but it's a leak of database name, not database contents. You can tell someone visited a website by looking at the name, but your photo from Google is safe.
As I understand it:
According to the source, Google inserts unique user ID is into database name. An attacker can make a request to Google, pass in this unique user ID into their API and get profile details, for example a photo back.
The attacker does not need access to the database data, only the database name, since the user ID is embedded in the _name_.
You are right it's a leak of a database name, but Google store sensitive data in the database name.