It'd be nice if there was a way to way that pile of emails at some authority and say "Here, this is the crap that's come of that data breach." Ditto for any authorized (but shady) third party data sharing.

Sadly we currently lack a consumer protection bureau.

This is the part the is really missing.

I use [email protected] whenever I sign up at random sites. Last night I got a bunch of spams at the just-eat [1] account (food delivery, operating in 13 countries so not a small operation).

Now I know they've been breached, but:

1. They haven't reported it anywhere.

2. I don't know of any meaningful action I can take.

[1] https://en.wikipedia.org/wiki/Just_Eat

They're headquartered in the UK, so I'd start with making a complaint via the Information Comissioner's Office: https://ico.org.uk/make-a-complaint/. The best option is probably "Your personal information concerns":

> If ... you’re concerned about how an organisation has handled your information – if the information is wrong, they have lost it or disclosed it to someone else – tell us.

You could submit evidence of the breach to security researcher Troy Hunt at HaveIBeenPwned (https://haveibeenpwned.com/FAQs#SubmitBreach). He maintains a database of data breaches and people can sign up to be notified if their info appears in a new breach.

That would be an interesting project, create the breach-via-spam sensor network via accounts.

It also might not be a breach, but could of been sold via some sort marketing 'partnership'.