KYC might have its function explicitly defined but when it becomes compromised, it then makes even the initial purpose of it not interesting anymore. Data breach in a company that holds large amount of personal information of their customers is very dangerous and if such happens, companies will have to face the consequences of allowing a data breach into people’s personal data that is suppose to be accessible to only the company for prevention against money laundering and making sure of compliance with the regulations. They need to protect people’s data by all means and for their own integrity also as a reliable company where personal data is saved with.
If any site that takes KYC documents and sells the document to another party, then howcan to identify that if they do not disclose and/or if they do not mention about the data breach. As the data can be shared from various sites, we usually use various types of websites each day.
Yes, no one will know our data has been leaked, because only they know. Unless they make a mistake that leads to detection and suspicion of a violation (leaking user data). Of course, that's difficult to uncover, and again, you're right that no one will know.
However, as users, we should be aware of such risks. So, before completing KYC, we should do so consciously and without coercion from others. So, it's up to us, because if we want to play there, we must be willing to comply with the rules. If we don't, we can find a casino that doesn't have such rules.