How come we haven't had big privacy scandals from Visa/ Mastercard?

Big companies, a rent-like business, no pressure to do things well, own lots of very sensitive personal data, clients giving the data away without realizing it, little regulatory oversight on the data front, etc.

I would expect them to sell or leak poorly anonymised personal data, leading to huge privacy issues.

Why hasn't this happened?