Cartlow leaked 2FA codes, gift card links, and personal data via an open Kafka broker, exposing millions of users to potential account takeovers and fraud.