It's always an unsecured S3 bucket. S3 buckets these days have deny ACLs by default, so it must have been an _aged_ bucket.

My sympathy for companies that decide to employ such tools is very limited.

Well, there's a shock. Play stupid games, win stupid prizes.

This is my shocked face