Online stores and other sites with a large base of paying users are hacked, and data leaks into the hands of attackers. You can do without hacking, if you bribe one of the employees of the site. An alternative option: buying a dying store with a database of all customers, after which the store is sent to the dump of history, and the base goes to the hands.