Data Brokers initiated their operation by exploiting LinkedIn's API, making unauthorized requests to scrape profile data. The operation was detected due to unusual patterns of API calls originating from external IPs associated with known malicious activities.