This is the only decentralized venue for chatter about law in the US. Federal law and law of various states and territories is on topic here.
Loosely related:
Not a direct answer to your questions, but still related.
I've had something similar happen (started receiving spam, so someone sold/leaked my information).
Luckily, I rent my own domain name, and use randomstring@mydomain.tld as email when registering. As the random string is unique for each service, I could easily identify the leaker, and end my business with them.
I do the same and I have traced unreported leaks to the source that way, but it is useless when the breach notice comes not by email but to the physical address.
The thread is about legal obligations and recourse. Consumers should have to do anything sneaky to be protected.