I would assume that any data sales have some sort of written agreement for what the data will be used for. In this case it would be that the people who signed the agreement lied.
Would you also assume that Grindr would have a privacy policy in the TOS which stipulates this as well? So, data buyer lied and thus made Grindr a liar to you, is Grindr the victim?
At what point do we have to say 'whoops, we got hacked/tricked/sloppy and your data is in the hands of bad guys, our bad' is not gonna fly any more. Shut them down. 1 Billion dollar fine next time Home Mart loses all customer files in a hack or SocialFace sells data to people who cause you to lose your livelihood for being gay.
2. There may have been a sale to a third party, from which the group bought the data.
3. The group may have used a shell entity to buy the data.