The data leak is most likely caused by the use of an insecure protocol. The vulnerability scan output shows that port 21/tcp for FTP (File Transfer Protocol) is open. FTP is known for transmitting data unencrypted, which could allow sensitive data to be intercepted during transfer.
Reference: The security risks associated with the use of insecure or unencrypted protocols are covered under cloud security best practices in the CompTIA Cloud+ curriculum.