> It'd be great if I could request who sold them my data, then go to that entity tell them to stop selling (rinse and repeat)

There are a number of companies (e.g. Delete Me) that offer that service. They wouldn't have caught the subject of this post since it was a breach.

The problem here arose from ID verification where you need to show your ID to an entity that then has the opportunity to store it.

Most of these companies are themselves data harvesting scams. You have to give them all your data so they know what to delete. Then they sell that data.