Security researcher finds trove of Capita data exposed online