I'm confused, did the band release the material or did the fake Hoserama?
2. Someone at that 3rd party copied and leaked the data.
3. One of the recipients (or the leaker) posed as Hoserama and tried to extort/sell/release them for $$$.
4. The band chose to release them for $, undercutting the fake.
Or someone broke into the 3rd party infrastructure and made out with the data. Music-related businesses are not exactly renowned for their cybersecurity standards. We'll probably never know.