Recently we have noticed that few of our customer and contractors are viewing pages which they shouldn't have access in the first place. What we have found they are inserting this particular url to the root site and all the groups and users information is accessible to everyone whoever enters information in this format.
Each customer and contractors have their own sub-site. Group is created for each of them "Edit" access given to them. They shouldn't have access to outside of their assigned sub-site.
Let me know if you need any further info to guide me through the fix the issue.