So this looks like it’s based in Java code.
A public class means that any bit of Java code, including that injected by an attacker, can see and mess with the contents of that class.
A private class, in contrast, means that other bits of Java code are restricted to running the class’s predefined functions.
In theory it is supposed to help with the security of the data. In practice if an attacker gets to this point, you’ve got much bigger issues.
This company wasn’t exactly targeted. It could have happened to literally anyone.