An internal misconfiguration at the KYC vendor exposed names, addresses, and passport numbers of approved investors. The sale has been delayed three weeks pending remediation.