Sensitive DeepSeek data exposed to web, cyber firm says