Do you use https on your main site? Because by not setting it up here for testing, and then uploading your entire backup unencrypted over http you exposed it to anyone in the way listening, including emails, password hashes, private messages etc.
What you should have done is created a self signed cert, used letsencrypt, or simply went over an ssh tunnel. All these would protect you.
You should probably edit your post so others don’t make the same mistake.