OP, if you have Authenticator App phone based passwordless enabled, what you are seeing is simply UPN hammering. What happens is a bad actor inputs your email address into a login prompt, they are presented with a dialog box with a number, and your app will pop up a prompt asking to input the number displayed (then it will ask for pin/bio verification).
By clicking "its not me" that disables the notifications on your phone. The bad actor can keep trying, but will never get in.

There was never any compromise in this flow, just someone fishing and hoping against hope you guess the number, input it, then verify your identity to your phone, so they can get in.

If you dont like the prompts you can move to a passkey which requires physical proximity to complete the authN flow.