I’m very careful with privacy and security so I was surprised I got an obvious phishing email from “American Express”. I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren’t American Express.
Look up “National Private Data Breach”. You’ll find a bunch of articles on it. Although someone else posted a newer one that I haven’t heard about so maybe that one’s worse. I would highly suggest that everyone put a freeze on your credit until you need to apply for something. Lots of identify theft happening since this occured.