it would be interesting if someone created a "Have I Been Pwned" service for these types of leaks, does anyone know if one exists?
Passwords can at least be changed, but data leaks are basically entropic; there's no way to reverse the damage. I don't want to stop holding leak sources accountable for what they lose, but from a personal viewpoint I'm now more interested in mitigation than prevention...
Where is this happening? I'm not aware of any company being prosecuted (or even penalized in any significant way) for releasing data.
Legally, or even on a consumer level, I don't see any kind of meaningful consequence. And the rate of data loss probably won't go down until that changes.
I think it's still keyed on email address though.