The company, in a statement, did not elaborate if it knew or was told how the source had obtained the data. It also did not specify what data was shared, nor the extent of the data