No need for multiple leaks, just one is enough.

And I wouldn't say "do something wrong", just getting infected with an infostealer. Happens all the time.