Card Factory, a popular UK-based greeting card business, stores some of its customers' data in an insecure way, letting anyone access their photos with an incredibly simple URL trick.
The site was notified about the issue on October 8 and hasn't fixed it...