IANAL and haven't explored the feasibility of this, but the CRA firms got your data via your banks because in the fine print when you opened an account there's

IANAL and haven't explored the feasibility of this, but the CRA firms got your data via your banks because in the fine print when you opened an account there's a phrase about "We will share your data with our trusted third parties". Well, the third parties haven't proven to be all that trustworthy, so suing your bank & credit-card firm(s) for releasing your information might be an interesting approach to take. If the CRAs have the source of their data cut to a trickle, they might start taking this seriously.