One guy in particular, I can't recall his name (Chris Vickery, maybe?), has been behind A LOT of these "discoveries"; specifically, a bunch of Amazon S3 buckets

One guy in particular, I can't recall his name (Chris Vickery, maybe?), has been behind A LOT of these "discoveries"; specifically, a bunch of Amazon S3 buckets that are misconfigured (WRT permissions) and wide open to anyone who wants to download the data. (I'll admit that I'm kinda curious as to how he enumerates all of them!) Based on the little information published, it sounds like that's what has happened in this case as well. The same guy has also found tons of wide open MongoDB instances and such. The guy you're referring to, Troy Hunt (HIBP) , writes about these cases but, AIUI, doesn't typically find them on his own. He's usually notified by the actual "researcher" -- this Chris guy in a lot of recent cases -- and they share the info with him.