Around 72,000 selfies and ID photos were exposed after being stored in a "legacy data system" containing information from more than two years ago. Recent DMs might also have been accessed.