The images were not taken. The table that turns 490 million private IDs into links was, with the uploader’s IP and whatever the OCR read.
The patch had existed for two years. The campaign needed no new capability, only servers nobody had looked at.