Well maybe it wasn't such a well secured company and also this seems story from the past.

Built-in positioning of network traces is relatively recent in mobile network equipment and dedicated probes.

If that happened more than 5-6 years ago, it would sound even less likely. Most telcos never bothered doing the processing needed to position raw events based on timing advances. They'd simply offload that to third party companies. These solution providers aren't crazy, they don't touch data that isn't already anonymized. It's even less probable that a random employee would have access to the multiple datasets needed to piece someone's personal data together.