IRCTC does not generally have much pii, except for adressess, phones, email. Aadhar can be linked but that on its own is not useful. Moreover a lot of accounts are burner accounts so the data is likely to be fake.

IANAL but, at the very least, you can't be charged with identity theft if you never actually use a stolen identity for anything.