Could also be that the attacker made a set of random API calls that returned private data, e.g. to test that his permissions are working, and received whatever

Could also be that the attacker made a set of random API calls that returned private data, e.g. to test that his permissions are working, and received whatever that API returned at that time without targeting any specific users (or caring about that specific data).