The average time it takes for a company to detect a breach is 6-9 months, but some companies have taken two or three years to find out data has been stolen. Therefore, it’s most likely that you will find out your data has been stolen and is being sold online by using third party tools to monitor your information online.
http://www.itpro.co.uk/security/25507/what-to-do-if-your-data-is-being-sold-online