Most scams start with a simple search, not a hack. Your personal data is already publicly available on data broker sites and used to target you.