Your mobile company doesn't need to sell the number..
It's possible to harvest phone numbers without buying them.
You set up a computer with some sort of telecoms system (be it Modem, VOIP or whatever). This system is running software that picks from a list of known exchanges. It starts dialling numbers on that exchange. If the number comes up unobtainable, it logs the number as dead. If the number comes up as enganged, or just rings, it gets logged as an active number and may be dialled later. As soon as someone answers, the computer puts the call through to a human. It also logs the number as being active, Initially, the system dials a lot of numbers (potentially millions), but as the list is built up, they can cut the number of calls. This is actually how email spam works, but they start out sending billions of emails.
The spammer, once they have generated a list of active (or potentially active) numbers, will sell it on to other spammers.
I don't know for sure if the spammers do that, but I suspect they do. The phone companies may well have equipment in place to detect it, but there are probably ways around that, especially if you fake your caller ID..