I'm kind of curious about this, admittedly out of naivety and ignorance.
The company posted a bunch of files (images in this case) to a publicly accessible file storage bucket and apparently with guessable / iterable naming conventions and no access restrictions in place. Suddenly they decided that was an oopsie, so that somehow makes it illegal to have accessed the images? Were the "hackers" supposed to infer the intended permissions and adhere to that instead of what was actually implemented? Is the crime that the images were shared after the company changed its mind and updated the file permissions on their server?
