There's a simple zero knowledge proof to show that you actually have the data. Have a CSV of username + salt + hashed(salt + email) + hashed(salt + phone number) , etc.

Users can check their own email/phone/etc to verify that the attacker has the data, without the attacker revealing the data.

I'm surprised this doesn't happen more.