I'm not sure this is a question which can really be answered. Once data is leaked, it is very difficult to determine where it originated. If it has something unique, we may be able to identify the source of the data and from there look for signs of how it was exfiltrated, but more often than not, it works in reverse. A company finds signs they have been compromised and then goes about trying to work out what data has been taken. There are frequently large dumps of data where it is not known where the data originated. However, this does not mean the data was extracted using some new compromise or vulnerability - it could just mean that the data was extracted from a company who is unaware they have been compromised.
The other problem with this question is that even if we can explain how data might have been obtained, that doesn't mean the explanation is correct. Once a technique sufficiently matches the facts to work as an explanation, we stop looking.
The other problem is that if someone has an unknown way of stealing/interepting data, they will keep it very secret and will be careful not to release data which would make it obvious either how they are getting the data or that they have access which was not previously possible. The biggest advantage they have is in keeping this knowledge locked down. Essentially, you would need another Snowden to find out about this.
Finally, there is a big difference between not know where data was extracted from and being able to explain how it was extracted. There are so many data leaks and so many possible vulnerabilities which can be extracted, there is little known released data which cannot be explained - that explained. That explanation may not be correct, but there is little which would be considered unexplainable, but for all we know, someone has cracked quantum computing, can break all common cyphers and has managed to embed back doors in the majority of harware supply chaines and we are just unaware of it. The unknown by definition is unknown.