Alternatively, the “leak” is a controlled disclosure of realistic misinformation.

The “leaker”‘s real life identity then “goes to jail” for 30 years and they work for the government in clandestine services under a new identity. This tactic confuses the enemy, and has the side benefit of scaring your own into being more careful with real classified docs.

If I was unethical enough to work for the security apparatus, the above is definitely something I would do.