Someone gains access to a DB for a site (through any variety of means) and then goes on Tor and tries to get people to buy their list of credentials.