No one "breached" the site. The pictures sat on a public-facing Firebase bucket, ripe for the taking.