It's probably kept secret because if we knew how easy it was to steal their data that would be bad for their image. Most companies have little to no security other than "no one will think to request this url". Could be a past or present employee who knows all the unprotected systems and wanted to make some extra money selling the data.