A security researcher discovered that one of the URLs in a company's website exposed millions of Aadhaar numbers without authentication. The researcher created a scraper to understand the extent of the breach.