Is it unlawful in the United States to sell passwords of other people?
If the passwords were obtained through malicious attacks on an organization's database, does that affect the legality?
Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title 18 USC§ 1030(a)(6)(A) [Computer Fraud and Abuse Act] provides that:
(6) [Whoever] knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if—
(A) such trafficking affects interstate or foreign commerce; or
(B) such computer is used by or for the Government of the United States;
... shall be punished as provided in subsection (c) of this section.
Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to any past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.