I have no doubt that a black market culture exists for user metadata and has existed for decades. I was surprised to learn once when working for them Ericsson retards that an employee had somehow gotten hold of private information of my bank balance details with the Commonwealth Bank.
This has less to do with cyber security and more to do with senior staff abusing their position of trust. I don't think CASA is immune to the practice either.
Please report your dissatisfaction to CASA immediately. A good result would be the person selling this private info ends up on the street.