Just to clarify to the downvoters: I meant "Secret" as in password, not as in "private data". It is a private data, but it shouldn't be used as a secret to pass some security check.

Where in the article does it say that the leaked information is used as a secret to pass security checks?

You are attacking a straw man here.