I think you are right, they probably got your PII from some data breach. Even when places get hacked and the attackers don't get usernames and passwords, they sometimes still get directory information that can be used for social engineering like this.