shouldn't the advertising agency having the data in the first place already be considered a leak?