Millions of rehab records leak, including patient names – nearly 150,000 affected