I had an employer that uses Santander for pension, within a day of them adding my info into Santanders systems my email that has never gotten spam before in over 10 years (custom domain, only every used for government stuff or employment stuff) got 20-30 spam emails. It keeps getting 10 or so a day since then.

Big banks WILL sell your info.