Several free VPN apps based in Hong Kong logged internet activity from millions of users then left that data unsecured on the internet for anyone to find.