It would be nice to know if this was a misconfigured AWS S3 bucket. My money would be on that. Companies are still learning this lesson, slowly and at all of our expense.