In the history of "breaches" or Identity Theft the victims are only made aware after their information has been stolen, not sold. Of course, it's impossible to track that. What thieves do with the information is not typically a direct attack, but ...