I think the bar to whether something is an "illegal data breach" or not, should be whether the security is half-decent according to most security researchers. Because in cases like these (and the one where someone almost got arrested for clicking "view source"), the vast majority of security researchers will agree that the security was terrible and irresponsible.<p>Even scraping public data could be a gray area e.g. if you're scraping a <i>huge</i> amount of possible addresses or de-aggregating on a massive scale. More importantly, you could <i>say</i> that you are doing this, e.g. claim that you found a "secret" 64-bit key by evaluating every possible one. But if your data is accessible via simple API requests, clearly there is limited "guessing" or brute-force going on.