Just a thought, but I wonder if https://loco2.com have it too?
Reading between the lines it seems they license the Hacon API from Deutsche Bahn
"It’s magic. :) To be honest, this is a strategic topic we can’t comment on. I’m sorry."
i.e they have it via a backdoor - someone is giving them it who shouldn't or they're scraping it.