I don’t know the answer to this, which is why I didn’t mention it in the post. However, I could speculate that these data-broker companies scrape leaked [hacked and stolen] data from various panels and then match records on their end. kinda OSINT for bad reasons.