German security researchers studying biometric capture devices popular with the U.S. military got more than they expected for $68 on eBay, The New York Times reported.

The shoebox-shaped device, designed to capture fingerprints and perform iris scans, was listed on eBay for $149.95. A German security researcher, Matthias Marx, successfully offered $68, and when it arrived at his home in Hamburg in August, the rugged, hand-held machine contained more than what was promised in the listing.

The device’s memory card held the names, nationalities, photographs, fingerprints, and iris scans of 2,632 people.

Most people in the database were from Afghanistan and Iraq. Many were known terrorists and wanted individuals, but others appeared to be people who had worked with the U.S. government or simply been stopped at checkpoints. Metadata on the device, called a Secure Electronic Enrollment Kit, or SEEK II, revealed that it had last been used in the summer of 2012 near Kandahar, Afghanistan.

The second SEEK II, with location metadata showing it was last used in Jordan in 2013, appeared to contain the fingerprints and iris scans of a small group of U.S. service members.

The device is a physical reminder that although the United States has moved on from the wars in Afghanistan and Iraq, the tools built to fight them and the information they held live on in ways unintended by their creators.

Exactly how the device ended up going from the battlefields in Asia to an online auction site is unclear. But the data, which offers detailed descriptions of individuals in addition to their photograph and biometric data, could be enough to target people who were previously unknown to have worked with U.S. military forces should the information fall into the wrong hands.

Over the past year, Marx and a small group of researchers at the Chaos Computer Club, a European hacker association, bought six biometric capture devices on eBay, most for less than 200 euros, planning to analyze them to find any vulnerabilities or design flaws.

Finding so much information sitting unencrypted and easily accessible shocked them.

How eBay sellers obtained these devices is unclear. The device with the 2,632 profiles was sold by Rhino Trade, a surplus equipment company in Texas.

A 2011 “commander’s guide to biometrics in Afghanistan” described face, fingerprint and iris scans as a “relatively new,” but “decisive battlefield capability” that “effectively identifies insurgents, verifies local and third-country nationals accessing our bases and facilities, and links people to events.”

One such device was purchased at a military auction, and the seller said he did not know it contained classified information. The latter was stored on the memory card, so the US military could have eliminated the risk by simply removing or destroying the cards before they were sold.