Experian sold personal data on 500,000 people to a company that made them available for "identity theft".