[Nextgrid]

Could it be that CRMs had their own contacts integrations which synced CRM data into someone's contacts, where a different app then scraped it and got pwned?