The affected data, covering residents of 12 counties, was publicly accessible for nine months before it was discovered.