Just because it's not openly shared does not mean that there aren't large databases of everything from working refresh keys to entire profiles indexed out there for the large services. Most data leaks and breaches don't get reported, or acknowledged, or are downplayed in their potential effect (but weirdly, also given more weight than they deserve since it becomes pointless to have so much data that doesn't add anything new to, say, a profile of a person)