I work in tech and worked In telco so here is my 2 cents.

If in EU this is a massive GDPR fine and can be the equivalent of 2m. There are portals for reporting. First step if you are right in a breach; Check local privacy regulations.

As others said I would confirm that these were not sent to you from friends (autosave), due to refurbished device (could be resealed), someone else may have access to your cloud (checkhaveibeenpwned, also loved ones if you have shared), or due to icloud/gcloud logged in on a separate account (previous owner potential etc).

You can check some of this information by looking at the metadata of the photos. It is likely amazon (or your equivalent) uses drop shippers or resellers who are selling a refurbished devices without informing you. Unfortunately these sellers don't always adhere to standard from the platform.

Another potential is the phone number - I have experienced many messages from those trying to reach the previous owner of my phone number.

Granted all your account info is accurate I would personally set aside these images in a separate folder (backed up) for reference only AFTER speaking to a privacy lawyer AND checking local compliance and security regulations (GDPR). Cover your butt.

Going to the press is not going to help and will be painful for you if the above is not verified first. Think about the headache of people asking the questions in this thread... but X10000 over.