The contract based exemption applies only to contracts the private person is a party in. If company X signs some contract with company Y, that has no bearing on any consent exemptions.

source: https://gdpr.eu/gdpr-consent-requirements/ on other legal bases for processing: Processing is necessary to satisfy a contract to which the data subject is a party.

The legitimate interest one is pretty fuzzy, what would the legitimate interest be here? "I want their data" isn't enough, I'm pretty sure.

I downvoted because your statement is misleading. A contract has to be lawful to be valid.

A contract could transfer users, assuming regulations are followed and users were acquired legitimately (both of which are debatable here). However a contract that requires to transfer users without notice nor consent is defacto null because it is not lawful.

These are extremely serious considerations for the case at hands. Companies knew what they were doing, the acquisition and PII transfer is not merely accidental, that should be covered in the contract. Depending on the wording and the intent of the companies (and any public backslash that might ensue and bring things to light), either side might lawyer up and reconsider the contract, or a third party like a regulator might jump in (could fine the parties or void the acquisition).