I edited my post after thinking about this for a minute, I bet the boomers just forgot to update some of their DNS records so it still points to an old host. The rest of their site resolves to completely different infra, looks like they just forgot to change over the storage subdomain (which they probably weren't using anymore).
All we really know is that someone spun up a BuyVM server, used it to dump the data, presumably downloaded it somewhere else, and then deleted the VM. And BuyVM accepts Monero, so good luck catching the hacker. This was fairly slick for a gay op to get middle-aged nudes, lol.