To be clear for people who haven’t read the article: the credit bureaus themselves are not selling information directly to criminal organisations. They are selling to other companies, who in turn may provide that information to even more third parties, who then sell it to data brokers. An example given in the article of what this data journey may look like was:

Immigration and Customs Enforcement has used similar data that flowed from utility companies to Equifax, which then was sold to data brokers.

The tools and databases owned by these data brokers are then used by criminals to sell information to anyone.

I did but found you have less than $20 in your savings…