a lot of them just get a 'rush' from the attack itself. but there are also many ways to use the information in evil ways some websites such as shadow crew sold the credit card numbers to "carders" who later on would order using others information.