They are trustworthy enough that I can rule that out. Could have been an employer of course. The list was posted online at some point. And the shop acknowledged the incident and is working with the police.

I used the quotation marks because of course the data was copied, not stolen, but the word "stolen" is usually used.