Cybercriminals acquire credit card data through various means, including data breaches of companies, malware infections on individuals' devices, and skimming devices installed on ATMs or point-of-sale terminals.