You are not wrong, however, I would have a hard time believing the NSA would hack a personnel database, and then sell social sec info and personal info to the highest bidder. I have no problem believing the chinese would.
The PRC is a state, not a criminal gang. They have the second largest GDP after the USA. Why on Earth would they sell the information? The more people have the blackmail material gathered by hacking the OPM the less valuable it is.