There are some posts from Princeton on password and CC leaks for trackers such as this, e.g.

https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfil...