According to Philip Greenspun's Weblog, it's quite banal: changing a URL to access actually blocked data. Not the supplier is fired because he is incompetent and the system is poorly secured - but the HBS applicants who used this "hack" to check their status before the official date are now not accepted to HBS. Because of changing a URL. Well, confirms all my prejudices about business schools.