This would be bad; we've already had a few cases on HN where someone noticed that they could increment the customer number in a URL or similar, resulting in police action.
This news segment goes into more detail about how he downloaded the documents (by incrementing the document id in the url) https://x.com/Brett_CBC/status/984751373525901313