So what happens with all this data?

I'm willing to bet some of it is pretty critical[valid credit card details?], it might end up in the Dark Web, auctioned off or something like that.

Some of it is useless (not valid anymore, or just junk emails used to sign up).

Cathay doesn't tell us what else has been leaked (or they don't know), but what if there's a team on the other end of the hacks that actually analyses the meta data of these hacks, and finds out the frequency of movement of some people, and add that to their 'alpha' ?