Databases get dumped, well, not all the time, but fairly often. See haveibeenpwned for example, they post a new breach once a week, if not more often [0].
HIBP even is basically tip of the iceberg in terms of how much data is floating around - Troy and his team only get the ones that are publicly leaked, or privately shared with them.
They also have historically had a backlog of data to process - leaked databases can be a pain to parse and turn into something usable.
They also have historically had a backlog of data to process - leaked databases can be a pain to parse and turn into something usable.