IANAL and haven't explored the feasibility of this, but the CRA firms got your data via your banks because in the fine print when you opened an account there's a phrase about "We will share your data with our trusted third parties".

Well, the third parties haven't proven to be all that trustworthy, so suing your bank & credit-card firm(s) for releasing your information might be an interesting approach to take. If the CRAs have the source of their data cut to a trickle, they might start taking this seriously.