If I had to guess, spear phishing is probably the most likely suspect, but there are a million ways for corps to lose data, from rogue employees, to sharing files over a public FTP server, to having an employees creds reused and in a data breach.