A hacking crew left their operations server exposed — 1.4 million target sites, custom scanners, and a command history log.

source