Web hosting provider exposes details of millions of clients in serious security lapse