I agree with what you said. This also wasn't social engineering. The password was just there and available.

Also, the excellent and amazing movie Hackers features plenty of social engineering.

Also, I didn't say "excellent" and "amazing" sarcastically. It really is an under rated movie.

you’re taking this splitting hairs to the moon today aren’t you, little troll

Troll? Where the hell are you coming from?

The thing everyone wants to see to dethrone this racist pile of shite and you’re over here like “it’s pronounced potato, not potato.”

So you have an issue with me arguing that people gaining access to this information are not breaking the law?

If i give someone my bank details and passwords and they empty my account, can I claim I've been hacked?

No.

So your claim is that if I sit down at a computer that isn't mine and has no security measures in place, and then open a file, that I have legally "hacked" the computer?

The minimal definition you can fall back to is "unauthorized access". But now you have to establish and argue that an unsecured computer/system is off limits to everyone except the owner. Which then opens up a big can of worms with network connected devices, and demonstrates that such basic and literal verbatim interpretation doesn't work in reality.

Well yes. It would be "unlawful entry" (or whatever it's called) versus "breaking and entering".

Richard chase vibes

Richard Trenton Chase was an American serial killer, cannibal and necrophile known as the Vampire of Sacramento, the Dracula Killer and the Vampire Killer, who killed six people between December 1977 and January 1978 in Sacramento, California. All of Chase's victims were chosen at random. Wikipedia

The base legal definition of "hacking" is "unauthorized access". Then the trick becomes establishing "unauthorized". The reason this matters is if a website is publicly accessible, then it's assumed to be authorized even though it's not explicitly stated by anyone. However, you are accessing information on a computer system you do not own and were not given explicit permission to access.

Now let's say in the HTML or JS there's an endpoint to a backend server that's not directly exposed via online searches or page links. And through that link you are able to expose sensitive data that's not shown on the webpage.

Now, how is the definition of "unauthorized access" or "hacking" applied here?

Edit: yes this is splitting atoms, but that's the world of legal definitions

In a legal context, hacking is a term for utilizing an unconventional or illicit means to gain unauthorized access to a digital device, computer system, or network.

We can rule out "illicit" because the FBI published the data publicly. Now the heavy lifting has to be done by "unconventional", which I don't think qualifies here. A government agency published the credentials, which means no one had to do social engineering, sneak into an office, reverse engineer anything, or even guess a person's birthday.

Now if this somehow went to court, a judge might rule that this qualifies as hacking, but my opinion is that it doesn't.