Are these details publicly-available for the scraping though?

I'd be suspicious it was an employee with internal access to the data or someone who had hacked such an employee's computer. Of course they wouldn't admit such criminal act and risk getting caught, they'd claim a route anyone could use.