They didn't share your contact information since technically the SPAM came from them (via a technology provider Criteo) so it's still Sears that's owning the communication and responsibility. It's different if let's say you were browsing Sears and then somehow got an ad for the Home Depot.
> It's different if let's say you were browsing Sears and then somehow got an ad for the Home Depot.
That's close to what happened.
OP got email from Sears, after browsing their site. But OP had never given an email address to Sears. OP had an account with (say) Home Depot. And then Criteo got OP's email address from Home Depot, and provided it to Sears.
No it wasn't fine at all. I certainly do not expect them to share my contact details without my consent, offline or not.