Most likely had someone in the group chat (opsec issue) or captured a phone and made the owner open it.

https://xkcd.com/538/