Yes.
Data from a breach ten years ago can be combined with newer datasets. When enough matching pieces come together, automated systems may approve accounts.
Exposure and exploitation are not the same event.
More here:
👉 How It Happens: Massive Data Aggregation & SSN Exposure
