At this point I assume most data breaches are just a criminal conspiracy between the corpo and data brokers.
No corporation bothers securing their data to a reasonable extent, so naturally they might as well choose the additional revenue stream of an "accidental" "breach" which is extremely valuable to surveillance capitalism. It's not like they face any significant consequences 99% of the time...