There are so many ways the information could have been leaked. For example,

1. Searching for things around chemotherapy, cancer, and death on some site

2. Having an app on your phone that tracks your location and sells it. Many apps do this. It's not too difficult to reverse engineer where people went and who they are with the various datasets that can be bought.

3. Data brokers getting access to medical information. Too many companies play fast and loose with their data. It would not be a surprise.

We leak data everywhere. Companies are often poor at following regulations. There are too few regulations in most of US around data about us.