> The repair shop almost certainly retains ownership of unclaimed deviced after some period of time. The shop owns the laptop. The data is theirs to do with as they please and they chose to publish it (at least, that's the story). No hacking necessary.

The "repair shop" is almost certainly a poorly-convinced backstory as to the origin of the hacked materials.

https://www.businessinsider.com/us-intelligence-analysts-hac...

But you are right in saying that hasn't been confirmed yet.