Taking data from a leaked site (e.g., a gaming forum) and "checking" it against mail providers.
These lists are rarely the result of a direct hack on a mail provider like Gmail or Outlook. Instead, they are usually compiled through: 6k usa have mail access.txt
Use services like Have I Been Pwned to see if your email has appeared in recent leaks. Taking data from a leaked site (e
Harvesting personal information, tax documents, or private communications found within the inbox [2, 5]. How These Lists Are Created 5]. How These Lists Are Created