This type of email would worry many individuals. Especially older persons who are unaware of technology and online scams.
To answer the scammer question: They got people’s information (name/address/email) from public record and T-mobile.
You read that correctly. Every year, T-Mobile enjoys giving hackers/scammers access to their consumer information.
Btw, I didn’t download/click on the email attachment .
Gmail has a feature called “preview”. It opens on google’s server.
2.9 billion records were compromised in the NPD data breach. You can check if your personal information is in the breach. This is how bad people get your info. You don’t have to enter very private info (first and last name, your State and birth year). My neighbor just told me he turned 81 years old so I was able to figure out his birth year and could see his data was in the breach.