It's probably kept secret because if we knew how easy it was to steal their data that would be bad for their image. Most companies have little to no security other than "no one will think to request this url". Could be a past or present employee who knows all the unprotected systems and wanted to make some extra money selling the data.

And those are important questions, because they get at "how can I make sure this doesn't happen to my company"

The details usually are that that someone left ssh wide open, someone else had a look at the logs and though 'Gee I don't think we should have anyone logging in from Belarus', and hiring competent people with enough resources would have prevented this.