If a hacker breaches the AMS database (using an SQL injection or a leaked employee VPN credential), they dump the file directory. That directory listing is then posted on a dark web forum or a Telegram channel. When Google indexes a snippet of that leaked directory, the search term is born.