There's this graph on the internets:
But I was unable to find any sources of the data. Most of the sites that present the graph seem to be politically oriented. Is this backed by any hard data?
The source of the graphic in the OP is Mother Jones.
This is what they consider a "mass shooting".
Our research has focused on seemingly indiscriminate rampages in public places resulting in four or more victims killed.
Mother Jones considered a specific list of 56 US mass shootings starting with the 8/20/1982 machine shop shooting where the shooter was killed by civilian using a car to hit the shooter and run over his body and ending with the 7/20/2012 Aurora theater shootings.
Mother Jones originally reported that of these 56 shootings, the data is as shown in the OP, but updated/revised the data to say out of 62 shootings through 2012, in 49 cases the gun(s) was/were obtained legally, 12 illegally, and 1 unknown.
Looking at the data table spread sheet, in many cases where they acknowledge that it is "unknown" where the gun was obtained, they assume it was obtained legally.
Also the list is incomplete. For example it does not include the 01 March 1983 fatal shooting of 6 people by Louis D. Hastings in McCarthy, Alaska.
See 6 KILLED IN ALASKA IN SHOOTING SPREE New York Times March 3, 1983
For another source see Where'd They Get Their Guns, An Analysis of High Profile Shootings 1963-2001.
This report gives more-detailed explanations of the legality of the gun purchases in the first 20 years of the Mother Jones data set.
EDIT: Ignore comments, significant changes after discussion and change to question.
This appears to be based on the data in a Mother Jones data set: US Mass Shootings, 1982-2016
The graph is absolutely based on reasonably good data but the conclusions someone might draw from the graph alone is lacking context.
There is a slight chance that these criteria might bias the fraction of illegally obtained weapons involved in the included cases.
The graph covers up to 2012 but motherjones expanded their dataset using the same criteria. We can compare to a database which doesn't have the same exclusion criteria
Data from Shooting Tracker tends to include far more cases for some of these time periods.
They use a very simple definition
Gun Violence Archive has always used the FBI derived definition:
FOUR or more shot and/or killed in a single event [incident], at the same general time and location, not including the shooter.