The leak happend because the celebrities logged into a fake icloud.com site which they opened by clicking on a link in a phishing mail.