Poor practices expose 24 million financial records