Contractor for Universal Music Group exposes internal credentials