Any number of things could happen; maybe someone got access to a code repository, or a stray flash drive, or the web server was mis-configured and served the file as plain text (happened to fb once) etc.