>The firm drew national attention when The New York Times ran a front-page story about its work with law-enforcement agencies. The Times reported that the company scraped 3 billion images from the internet, including from Facebook, YouTube, and Venmo. That process violated Facebook’s terms of service, according to the paper. It also created a resource that drew the attention of hundreds of law-enforcement agencies, including the FBI and the Department of Homeland Security, according to that report. In a follow-up story, the Times reported that law-enforcement officials have used the tools to identify children who are victims of sexual abuse. One anonymous Canadian law-enforcement official told the paper that Clearview was “the biggest breakthrough in the last decade” for investigations of those crimes.
This makes it sound like someone walked into their building, grabbed the list off someone's desk and walked away. How did such a critical list get stolen?
If I had to guess, spear phishing is probably the most likely suspect, but there are a million ways for corps to lose data, from rogue employees, to sharing files over a public FTP server, to having an employees creds reused and in a data breach.