So many companies have been hacked it's unfathomable.
but there also are many fake emails and some that duplicate company emails. You'll find any company but mostly ones that are financial. The email (which can look exactly like a banks or whatever) say there was an issue and they need you to log in to you account.
They have a duplicate of that companies login screen
You login.
Then the hackers have your ID and password
and get to work, ordering stuff .. moving out cash, etc etc etc
The main key is if you receive an email DO NOT use any links in that email
and refer back to the companies website or call their support and ask them for confirmation.
Also, so not make automatic / monthly payments from a company. They store your CreditCard / bank numbers, though encrypted, can still be compromised.
Yes, make your own payments monthly.
There's so much to this you can't review the entire mess in a post.