Immediately after S’s application season, DH started receiving lots of college junk mail related to MBA programs. We definitely suspected data mining, so call me paranoid along with the OP.
Also, a few years after my son applied to Columbia University and was rejected, the college’s application files were stolen. Back then, Columbia was not even on the Common Application and so DS sent a snail mail, paper application. The school notified the students of the security breach and provided them with credit monitoring, but not their parents. We were very surprised they had kept the files of REJECTED applicants for several years such that they were among those taken! Now why would they do that if they did not have a use for it unrelated to the application process?