This is the case when attackers don't get access to the database itself - imagine they were able to listen to connections between users and front-end servers, and extracted authentication information. This would only concern users connecting during a specific timeframe.
In this post for instance, they indicate that attackers got 'sync users’ passwords' while storing only 'encrypted/hashed data'.
Other possibilities: they accessed a partial backup (or prod data used in dev), a caching system, a message broker (Kafka)...
This is legal[1] in Europe if you consented to receive marketing emails from "partners" of a website you subscribed to (through an opt-in, not an opt-out checkbox).
You subscribe to website X, you opt-in to offers from third-parties, and this allows X to share your e-mail address with Criteo. Then Criteo sends you marketing e-mails for the account of Sears (but they surely don't share any PII with Sears - the e-mail is sent by Criteo).
The logic isn't that "browsing Sears is considered as having a preexisting business relationship with them". It's because users opted-in to third-party communications from a website they may have signed up with, back in 2008.
Other similar use cases include sending you an e-mail for website X when you browse website Y because they know you are in front of a computer/phone and this increases chances of opening e-mails.
Doesn't make it more or less "right" though and it's surely very surprising for users, myself included.
(On a tangent, what still looks like a legal gray area to me are the Data Management Platforms (DMP) - everyone shares user data in a big bucket/database provided by a common partner, all users are identified with IDs but not directly with PII, how much data can companies push/pull legally?)
[1] Not a lawyer but worked with legal teams on these topics. Laws still differ slightly depending on the European country you're talking about, but the GDPR will soon be unifying data privacy regulations. Right now the French and German Data Privacy regulations are some of the most restrictive ones.
It looks like a way to enable 'click-to-play' by default without over-annoying users (normal 'click-to-play' sometimes shows the Flash experience even when an HTML5 experience is available). It's also good for security as it makes it more difficult to exploit Flash vulnerabilities (especially in ads). It may be the first step before sunsetting Flash completely as you suggest.
Often it's because they already licensed their original content and gave exclusive rights to a local company before launching Netflix there... And it may differ season by season for the same show!
As I understand it, when you send a question, random customers get mails from "Amazon Answers" titled "(First Name): Can you answer this question about (product)?"[1]. And even if they can't, they still answer to the best of their knowledge which sometimes leads to half-helpful discussions.
In this post for instance, they indicate that attackers got 'sync users’ passwords' while storing only 'encrypted/hashed data'.
Other possibilities: they accessed a partial backup (or prod data used in dev), a caching system, a message broker (Kafka)...