Always server misconfigurations that leaked IP address or allowed feds to hack into it. Some users were busted too, it seems at least a lot of them were busted with photographic forensics but nobody really knows if any were traced with technical attacks.