The footage recorded by security cameras in Metro trains and stations can only be accessed by DMRC officials and CISF personnel, who look after the security. CISF and DMRC control the database into which this CCTV footage goes, and so the leak most likely has happened at its end.