Where does the compromised database come from?

We aggregate publicly available reports from collector communities and forums, plus ongoing marketplace monitoring (e.g., recurring suspicious listings). We update the database frequently.