At least Meta has contracts with hospitals where hospitals share “anonymized” patient files. Except, at Meta (and google, etc), they also track your location (at a doctor visit, for instance), to be later correlated to these patient files.
Depending on which country you live in, you can literally buy huge leaked datasets of the general population in certain corners of the darknet
If you're from the USA — your data costs significantly more, because overall it's still guarded much better there.
But in a huge number of third-world countries, or even in many parts of Europe, there is so much data floating around online that, for example, datasets covering 90% of the population of some countries — including almost full document scans — can cost something like $50
And I'll go even further: hackers, companies, and scammers constantly trade and exchange these databases with each other.
There's also the whole phenomenon of phishing/insider groups: a guy gets hired for a real job at a company, sometimes even quite a good specialist, and then just quietly leaks the data to his hacker crew.
In other words — this is often a genuine expert in the field, someone companies are happy to hire for their skills… who just turns out to be part of a phishing/stealing group.
And now, especially when you can get an IT job (in tons of places) completely remotely — this is exactly what you end up with.
