Yes. The article didn't mention whether the identity of the seller would be sold as well. Knowing that a person exists in the world whose corporate password is "FuzzieBunn1" isn't a terribly useful piece of information. Furthermore, did survey participants perceive that there might be some risk of being caught selling access to one's company? In most countries, doing so must be a crime of some sort. In general, I'm skeptical of the survey.