How to programatically add attachments to a user (securely)
You want to try and use the drupal api to move these files into drupal. Since you talk about private files, I assume you've enabled a private filesystem ... or else this discussion is pointless as all your files with be public :).

Once you've done that you could take your hundreds of files and put them in your server someplace and use file_move to place them into the drupal private filesystem using a small php script.

A module tutorial with a private file upload widget can be seen at this blog post and uses the drupal api to store a private file. Private files typically use hook_file_download which that blog post also shows to allow access to the file.