As for passport data there is tons of points of leakage too since Russia have well-centralised online government services and tons of people have user-access to these databases. E.g people in police, medical services, education, tax departments, local government, etc.
And obviously salary of most people with such access is well below $1000 / month after taxes so they are happy to sell any information for few hundred dollars. Imagine it: all spy agency staff profiles don't have "TOP SECRET. PLEASE DON'T LEAK THIS" warning on it,
> “I don’t want to be too dramatic, but we love this,” said Marc Polymeropolous, the CIA’s former deputy chief of operations for Europe and Eurasia.
> When former Russian spy Sergei Skripal and his daughter were poisoned, it was Bellingcat that was first to publicly identify the two Russian military intelligence operatives that had traveled to the U.K. to spritz the door handle of the Skripals’ home with the Soviet-era nerve agent.
> “Whenever we had to talk to our liaison partners about it, instead of trying to have things cleared or worry about classification issues, you could just reference their work,” said Polymeropolous, who retired from the CIA in 2019.