What gives you the impression that's the case? The impression I got is that the "third party supplier" was the company contracted to operate the backup stream, and thus was entrusted not to divulge the information (similar to how employees of public companies can't divulge or trade on confidential information they have access to). This isn't a case of BOE leaving information unguarded, this is a third party abusing information that they've been entrusted with.