Understanding the supply chain of stolen data