What typically happens is a company gets hacked due to poor IT infrastructure or hiring idiots who do not know a thing about internet security. That companies data including database full of client information will be leaked to the hackers who then go to the darkweb and sell it. Then other criminal scum utilise that data to pull off scams. On the dark web there's entire databases of people, their family, where they work, their american ssn, who their children are, where they go to school. It's fucked up but that's what happens. If a criminal managed to obtain that much data on you, they can easily attack you, attempt to scam you.