I'm very careful with privacy and security so I was surprised I got an obvious phishing email from "American Express". I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren't American Express.
A few months ago was the largest data breach possibly ever. Something like 300GB of personal information. Basically everyone in the US. They have everything on everyone and it's being passed all around on the dark web like skittles. The mainstream media didn't cover this for whatever reason.
Look up "National Private Data Breach". You'll find a bunch of articles on it. Although someone else posted a newer one that I haven't heard about so maybe that one's worse. I would highly suggest that everyone put a freeze on your credit until you need to apply for something. Lots of identify theft happening since this occured.
"My neighbor Jerry wrote his password on a post-it note and stuck it to his monitor that I can see through the window. Let me just add it to the database..."
LARGEST PASSWORD LEAK EVER RELEASED BY BOB SMITH OF 123 MAPLE ST!!!