They are hacking huge credit card processing centers databases, or databases of huge stores, where they have inside man working for them. But hacking is the way how they usually get their DBs. Not an easy job by the way.
when you buy dumps you buy security, you dont have to put yourself at risk. The dumps might be flagged and wont swipe as high but your better off buying dumps.