This is called federation or multiparty security. Only authorized contact tracers can piece together the puzzles. All the players in this ecosystem do not have any personal data that they can use to re identify you. Even if some of them suffer cybersecurity threats, no incidents access those data.