private files are no longer private
Drupal should have created an .htaccess file in that directory with Deny from All per the File documentation. Check to see if this is the case. This post may also be helpful: Noob question about private files and Content Access.