KrebsonSecurity has the story (a good security blog)
a 24 year old Viet-Nam (Ngo) national helped create a situation where data from Experian was sold to online identity theft rings.
The company Court Ventures helped cause the situation.
but this is the important sentence: ” According to a transcript of Ngo’s guilty plea proceedings obtained by KrebsOnSecurity, Ngo’s ID theft business attracted more than 1,300 customers who paid at least $1.9 million between 2007 and Feb. 2013 to look up Social Security numbers, dates of birth, addresses, previous addresses, phone numbers, email addresses and other sensitive data.”
This is how it works, once your data is online and in digital format, it is easy for people to steal/borrow/buy it and then sell it on the open market.