They got the data from Training Peaks allegedly, not from Sky. Could have been obtained in numerous ways:
Hack TP to have access to all data for anyone (unlikely)
Target an TP account that has access to Froome's data either by 'hacking' or social engineering someone who has that access (maybe)
Find it because someone accidentally left it, a link to it, or login credentials lying around (e.g. unscrubbed laptop) or a URL visible in a PowerPoint presentation (possibly)
Get it from someone who works at TP itself (most likely)
They got the data from Training Peaks allegedly, not from Sky. Could have been obtained in numerous ways: