What is quite remarkable is that actually possessing or selling the database may not be illegal, there have been some interesting cases. Only "obtaining it" and "using it" are.

If they can't prove you stole them and can't prove you used them you may be in the clear.

This depends on your country though.