You don't necessarily need to get your hands on the actual database. You can also obtain the data through a side channel such as debug pages or errors messages being a little bit too generous with information.