[black_puppydog]

wait, why do they need users' emails?

[tinus_hn]

If you want, you can create an account to ‘sync your ghostery settings’. The username of the account is your email address.

The exposure happened because they sent a mail with a lot of people in the CC: field. Amateurish but it happens. The irony is that the mail was to inform you of the privacy changes due to GDPR.

[Cthulhu_]

They don't, that's the thing; they wanted to monetize their service, and selling e-mail addresses and user data is one way to do that.