I’m very careful with privacy and security so I was surprised I got an obvious phishing email from “American Express”. I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren’t American Express.
Someone who you’ve corresponded with over email had their address book compromised and it was used in a mass phishing email campaign. It’s not necessarily targeted at you. I actually have experience of this happening. I had an email address that I used only to correspond to a single person. I never gave the email to anyone else and never signed up for anything. Well that person’s email was compromised and I started getting spam/phishing emails shortly after that.