TL;dr: this wasn’t on the open web but an internal network file share open to anyone on the network. It was found by a contracted pentester, and was just one of many failures of the company’s network security. The tester’s boss told him to delete it since it looked confidential, but when presenting the results to the client, the client’s security team denied that the contractor had found what he’d claimed and soon deleted the files. The contractor didn’t have the evidence of what he’d found since his boss made him delete it. When checking later the tester was still able to access the file share, it simply didn’t have those files anymore.