CircleCI claims their leak happened through a “third-party analytics vendor“. Perhaps that third party was Segment?

Not much of a conspiracy theory needed. Supply chain tends to be easier to attack than high-security firms themselves, and so are valuable targets.