Well, it could also be the case that everything is working as designed, and that they gave your address to someone else who did have a data breach or is themselves sending the phishing emails.