To be fair this kind of vulnerability is kinda common. All it takes is some AWS bucket to be left public. Surely you've seen it on HN for years? MongoDB for com

To be fair this kind of vulnerability is kinda common. All it takes is some AWS bucket to be left public. Surely you've seen it on HN for years? MongoDB for company X found with no password, government AWS bucket left public, etc. That said it would be a feasible yet simple story to fabricate. The details aren't that important, just saying "we found a file with ip addresses that had services open with no password" is plausible but also not that specific. Seems like all they need to do is publish their communication now that the vulnerability has been fixed?