The 3rd party firm is the one that wants the data. No need for someone to steal it from them.