If you ever buy anything with a CC, use a "membership" card anywhere, or have anything delivered, or for that matter purchased online, then there's a greater chance than not this data was shared by the merchant, transaction provider and/or the credit card company themselves.

If you have an online profile, with any friends that aren't paranoid, and allow your friends to see any private information, then this can be collected/correlated by the various bot farms.