They didn't look through the list, someone else did, found several references to Blue Toad within the data (more than was statistically probable without some connection to Blue Toad), and contacted the company to warn them it might be their information. They then did their own search, found that it was their data, contacted law enforcement and NBC.