Exactly... for them to "benefit", they would have to:

Apply for jobs at the other companies with better plans, proceed with interviews, offers and then finally accept one and quit their job at their current employer... To reap the rewards of their malicious hacking...

More directly, they as employees could pressure their bosses to renogtiate the insurance contract.

It wasn't just plan details though... They accessed names, SSNs, etc.

Not on purpose, and they didn't keep or memorize it.

The GP comment says "After I shopped a few other companies to see how our plans compared". That sounds pretty "on purpose" to me.

What does "keep or memorize" have to do with anything? They intentionally abused a misconfiguration to view private information.

I think it's reasonable to disagree about the ethics of that, but I don't think it's really debatable that it was intentional.

They were intentionally viewing plan information. The personal information wasn't the goal and wasn't retained.

"private" information is too vague of a term.