A friend had his information (leaked from some company who he used to buy products from its database) used for this. I wonder if they usually get their informat

A friend had his information (leaked from some company who he used to buy products from its database) used for this. I wonder if they usually get their information from stolen user DBs