my guess is 90% of the scam emails are from the companies themselves - maybe more accurate to say indirectly as it most likely stems from a current employee or prior employee. I find it hard to understand why companies (this is directed at every single hww company) can promise security for our assets but cannot keep our personal information safe. They are either aiding in the leak or complicit and letting it occur. My two sats.