Another possibility is purchasing an old phone from Ebay and extracting deleted files. Or a local mac/pc/phone repair shop pulling the data during a repair. T

Another possibility is purchasing an old phone from Ebay and extracting deleted files. Or a local mac/pc/phone repair shop pulling the data during a repair. Then theres the nsa/border sec vector too. Photos uploaded to a mac or pc could also be malwared or malicious apps. Theres the ex/friends/family as possible weak points too. Plus we have no idea how long these photos have been traded within that private group. What i'm saying is there are lots of ways this could be done and we shouldn't get so hung up on the icloud idea.