Misconfigured S3 bucket exposed international passport scans and identity details listed on watchlists.