The article misses an important point. While sophisticated actors might hack a broker to get the information, a sufficiently connected and funded actor can just purchase it from them. See for example
https://www.tripwire.com/state-of-security/security-data-pro...