3. is incorrect. the leaker wasn't trying to extort, he was trying to sell individual tracks. He then just released the whole thing online, posing as Hoserama, to try and save face. So we have had the leaks for over a week now.
> Someone at that 3rd party copied and leaked the data.
Or someone broke into the 3rd party infrastructure and made out with the data. Music-related businesses are not exactly renowned for their cybersecurity standards. We'll probably never know.
Sorry, too late to edit. You're right, much of this (all three points?) are speculation/hearsay/guesses. I'm just summarizing what's been reported, I don't have any special inside information.