I don't see it as him monetizing the stolen data, but the mere existence of it.
He didn't orginally steal it. He collected the illegal dumps and runs a service on top of that data.
There is nothing wrong selling stolen data provided someone else dumped it first.