having the iwo jima flag is the standard.
it can be spoofing, hacking, infiltration or deliberate treason. all are possible.
In case you've been wondering why you've been getting so much more spam since then.
https://thehill.com/policy/technology/4565413-about-73m-current-former-account-holders-impacted-by-data-leak-linked-to-dark-web-att/
"The preliminary analysis showed the data set is from 2019 or earlier, according to the company. AT&T said it currently does not have evidence of unauthorized access to its systems from this month’s leak. "