They don’t have to tell you shit, and they don’t. Only in CA do they even tell you if your information was stolen, unless it’s going to come out in the news and they don’t want to look like what they are.
Worst case, if they got prosecuted, they’d negotiate a fine and not admit responsibility so no one could use the government’s case for a civil suit.
You said that the third part shared my data with you after you sold them to them, this means that you have my data.
They don’t have to tell you shit, and they don’t. Only in CA do they even tell you if your information was stolen, unless it’s going to come out in the news and they don’t want to look like what they are.
Worst case, if they got prosecuted, they’d negotiate a fine and not admit responsibility so no one could use the government’s case for a civil suit.