You've been able to find these for years. In fact it's entirely possible they just grabbed some or all of them out of an existing torrent originally.

It would completely not surprise me if there are automagic attacks on net-ntlmv1 at this point against some cloud hosted storage. This has been doable by anyone since like 2016 if you had the space and weren't prevented from using that protocol version.