Public and Private file system path is the same
The private files path should always be outside the webroot directory since users can directly access all those files through just adding /sites/default/files/private/.. to your URL. Private files means that they are delivered through Drupal to add some access permissions.

What you should do now:


Backup your databse and put your site into maintenance.
Go to your files_managed table and find all files stored as private files.
Move those files to a new directory outside your webroot.
Change your private files path to the new path and test if everything is working.