Stolen credit card data are sold on underground markets, along with the malware and tools the thieves need to steal the data themselves.