Nobody is sure how they did it. Or even if it comes from iCloud.

The leakers themselves claim it was from iCloud (the actual leaker only bought it online from various hackers though, again according to him).

According to the person who is actually leaking this pictures to popular forums, he acquired many of the pictures either by trading or buying them from the -real- hackers on one of those shady online marketplaces.

He claims the hackers got them from iCloud hacks, and other more social engineering hacks.