She did harvest from data brokers. The AP article doesn't really get into this, but the SEC complaint (https://www.sec.gov/files/litigation/complaints/2023/comp

She did harvest from data brokers. The AP article doesn't really get into this, but the SEC complaint (https://www.sec.gov/files/litigation/complaints/2023/comp-pr2023-74.pdf https://www.sec.gov/files/litigation/complaints/2023/comp-pr...) explains: "Knowing that JPMC would have access to Frank’s real and much more limited student data after the close of the acquisition, Javice and another high-ranking Frank executive (the “Frank Executive”) began an effort to create a list of real names that they could pass off as Frank’s customers. To that end, the Frank Executive arranged for Frank to pay $105,000 to a third party data compiler for its in-college student data. Javice arranged for Frank to pay $75,000 to a different data compiler to augment the list the Frank Executive bought with email and phone number data."