Arts Council's website had 20,000+ attendees' personal data — names, numbers, payment history and left it completely exposed for 5 months