Seems crazy until you realize politicians write the laws
Car dealerships. Heck, even the DMV. Sign up for Credit Karma? Enjoy credit card offers arriving to your house. It seems everyone is "in" on selling/sharing our data. If you ever read the terms of services, you'll usually see a "third party partners", or something like that, which mentions how they "share" your data.
Opt out should be the default, but it isn't.
There are a number of companies (e.g. Delete Me) that offer that service. They wouldn't have caught the subject of this post since it was a breach.
The problem here arose from ID verification where you need to show your ID to an entity that then has the opportunity to store it.