The FBI is investigating how cyber criminals obtained medical records and naked patient photos from a Las Vegas plastic surgery office
“How” is probably not going to be interesting. It could be someone opened a dodgy email attachment at work. It could be that the files were never secure and were on some public facing server with default passwords.
Our systems are fundamentally broken because they rely on every person with access having some expertise, and being vigilant. But that’s virtually impossible.
These sorts of misadventures happen all the time, just not usually with nude pictures coming out.
The way “how” might be interesting is if somebody from the inside intentionally leaked them.