<p>Abuse of private firm's access exposed 8.8M records, including those of people who had died or moved abroad</p>