Prosecutors say a 20-year-old ran a marketplace selling stolen data and attack tools, pulling in more than $500,000 since 2023.