Raidforums and similar have them. You occasionally find them on reddit and small security blogs. I collect data breaches, and usually by the time you hear about one on HIBP it’s making the rounds on a variety of forums. Only on a few occasions has Troy actually gotten anything exclusive.