I disagree with using "debanking" as an example. At least in the US, banks are required by law (the Bank Secrecy Act (BSA), et al) to not divulge certain information. As far as I'm aware, YouTube et al are not under such a legal requirement.
The effect is the same, though.
While we did not divulge your certain information, we regret to tell you that your certain information was access in a hack that was discovered (9 months later).
if they intentionally or unintentionally were the source of that certain information, there's little recourse for you after the fact