It sounds like extortion to me. I wouldn't be surprised if the data leak was an intentional move to provide incentive to people to sign up for their credit monitoring services or unfreeze fees.
Every time you use credit, you'd be authorizing that creditor to add events to the records for that use, until they mark it paid off. Otherwise, nothing else gets into your history. And you'd be able to comment on any of those events, of course.