I understand at an elementary level how data breaches tend to be distributed, starting with friends of the attacker/discoverer and then being distributed via forums, paste bins, etc. However I was wondering is there a common location/forum/method that this occurs on.

I am not looking for data breach lists myself, but feel as a security person knowing how to obtain one would be useful for improved threat modelling and consulting instead of defaulting to the generic "They are sold on the dark web!" statement.