I could be wrong on this, but it's my understanding that they didn't have a robots.txt and Google started indexing their private URLS.
I could be wrong on this though.
Yes your wrong. One of the few things we know, is that the "Google index url" problem wasn't a security flaw and couldn't have been used to hack them in any way.