You should read what I wrote again.

I said if the dump was for another service, it was reused. Otherwise the dump was literally for the service that gave them access to the CPR data. In either case it was found in a data dump - that has been confirmed.