This type of information is used all of the time to discover and compromise web accounts of the victims in bulk. There are scripts that take in this data as input and will do a lot of the work for you to take over their accounts (or at least find their active accounts across web). Any additional data you are able to trawl can be sold itself, leaving the next steps to more advanced or motivated threat actors.

It’s also useful for more targeted social engineering attacks.