They're possibly telling the truth. Maybe they weren't breached. They may have just sold their customer list to to one of their "marketing partners" who was either breached or are the crooked actors themselves.