[mdani]

If I can make a guess, I'd say that the reporters engaged with them as a potential customer and demanded a sample of the data so they can indeed verify the accuracy. That's how they obtained the sample records, not via a s3 leak.

[r4nd_f]

The reporters published a YouTube video in which they went undercover to a security convention (ISS Europe), and requested information about how the product works, some usecases, etc. [1]. Although, I don't recall the presenter indicating anything about leaked sample data...

[1] https://youtu.be/xfWyU5iXJ3I