They buy it from your telecom provider for pennies on the dollar, then connect your phone number to the shadow profile associated with your identity scraped from your friend's posts, photos and uploaded contact info.
Very common in regulatory derelict-states like the US. The solution is consumer protections, not begging for a stronger corporate nanny.
They don't. These are entirely new datasets.