Leaks can happen in many ways, like simply by SQL injections, some page displaying data without server side validation/with bugs, etc.