Remember that this is a numbers game. They don’t need to convince everyone, just enough people that they make a profit. Say they get their hands on a breach data set with 50 million people – if you live in a low cost of living country with negotiable law enforcement like, say, Nigeria or Russia how many of them do you need to sucker at $1,400 apiece to pay for the cost of generating a few million emails? I’d bet that anything over the first few is pure profit.