Stuffed toys database left personal data exposed, says security expert