Unfortunately, Photography, and photography with costumers especially, is a weird area. It seems to really depend heavily on the setting. In general, when it comes to photography as like, “Art,” from my understanding it usually the photographer, not the subject, that owns the image. Now, lots of times in a private setting, the photographer will have a model sign a release form, but I don’t think those are needed if the picture was taken at a public event with no reasonable expectation of privacy. Which it looks like this was. In fact, many conventions have terms of service either directly on the badge or on their website somewhere that you have no reasonable expectation of privacy and your image may be taken and used for commercial purposes.
So, while the image might be of a 405th member, the photographer who took the picture might be the person who has the ultimate say in when and where the picture is used, especially if this was taken at a public event, and even more so if it was taken at a convention, which it appears this was. So, even if we identify the costumer, they very well could have absolutely zero "recourse" as the picture was taken at a convention by a photographer who then legally sold it to a place like "Getty" stock images, who then sold/licensed it to a commercial entity.