The source of the information could also be a rogue employee at any of those places, especially for something shady, like robocalls.

In most places, it is not difficult for an employee, especially someone like a sysadmin or a DBA, to simply siphon the data into a CSV. Chances are that no one will ever figure it out.

I think that once law enforcement catches up, slow as they always are, they will start creating honeypot identities and then tracing the information leaks to their source. For now, there is little to be afraid of for the leakers.