So, it sounds like as it stands now, judging by the verified GDPR data breach, Conor is the verified accused party. It is just a question of if it was consensual or not, with a lot of rumors, that may or may not be true, mixed in.
A data breach can be due to false info leaking too.