It happens everywhere.
http://www.federalreserve.gov/bankinforeg/reglisting.htm
Cause, I don't think they broke any rules. Are they even required to keep those details secret? It's pretty clear marketing agencies can buy that data, so i don't think it's any sort of violation of privacy policy.
...i hope