It depends of what you mean by "legal means". If the leaker is a developper, then it is an obvious violation of the NDA.
However, I've once been told of a case. An animator who was working on a Disney animation movie who had invited guest at home. She didn't secure her computer and left footage...