Or someone broke into the 3rd party infrastructure and made out with the data. Music-related businesses are not exactly renowned for their cybersecurity standards. We'll probably never know.