Custom Login URL Breached

Hi, I have a custom URL for WP login set up. It works great. BUT – I noticed that there were a heap of attempts to log into that URL recently. I thought the URL was secret / hidden, so how can a hacker have access to that?