I don't think it's just private companies. Its really any thing that has data I think. I used to work at the largest telco in the country on a software project

I don't think it's just private companies. Its really any thing that has data I think. I used to work at the largest telco in the country on a software project (as a consultant) that involved some integration with existing services. With some playing around it soon became clear that all services were wide open as long as you were on the internal network, you just had to know what they were and how to call them. No authentication required, no audit logs as far as I can determine. I didn't poke at it too much, but I was able to at least read an arbitrary cell phone's text messages and call logs.