Ask HN: Anyone else private information get sold by namecheap?

I have domains purchased through namecheap with privacy turned on for .com. .ca domains are private no matter what. And yet I'm having call centers call me. I asked where they got the information from, and they said namecheap.

They didn't work for namecheap.

Do I have any legal recourse or am I screwed.