Some companies just blatantly sell your data. Others get breached and you are part of the package that gets sold by the hackers.

The only “way around” is to use unique mail addresses for each signup/company so you can easily lock it and switch to another one when it gets known.

Just assume, that everything that you type in a form online (or in any other way send to a company/another person digitally), every email you send, everything that gets digitized about you, etc. will be public one day. Either because the other side of the transaction sold it or because they (or you) will be hacked eventually.

Btw: HaveIBeenPwned does not necessarily contain all breaches. I have several notifications of companies that got breached and leaked my data that are not listed in HIBP…