1. There are no hackers and Mark made the leak himself (and did not reveal december, january and february in order to protect the ''thieves'')
On a closely related note to option #1, note that the original post and data dump is still posted on Mark's personal blog, several hours later. I do find that somewhat suspicious. It shouldn't have taken particularly long for Mark to notice, and to take corrective action to remove the post and data (assuming he is able).
http://blog.magicaltux.net/Coulda been sleeping... its like the middle of the night over there.