Transunion data used for unsolicited calls

I just received a call from a lady at Conducive Group trying to sell me insurance. When asked where my number was obtained from, I was informed it would be in their data base based on a previous opt-in option for marketing. Since I never opt in for marketing communication, I requested once again who the provider of their database is, upon which I was informed that it was Transunion. Please let me know how it is that credit bureau information has been obtained when there are ongoing articles regarding a supposed hack of South Africa's credit bureaux where data has been obtained?