A HTTP server may as well equate to a public building with a sign outside saying "Come in and take whatever you want from any room at any time, unless the room's door is locked!" (locked = authentication)

The Nova Scotia govt forgot to lock one of those doors and are now furiously trying to shift blame. I haven't seen them apologize or address their own internal incompetence in any of the news articles I am seeing about this.