I'm guessing they mean on Tor-only websites.

Yes. I could have been clearer but didn’t think that was a sticking point.

No worries, sorry for picking up on it. I've not heard it used in that way before so wasn't sure if there was something else I was missing.

Someone gains access to a DB for a site (through any variety of means) and then goes on Tor and tries to get people to buy their list of credentials.