It's been going on since you could enter details online somewhere. Late 90's maybe.
Phishing for your hotmail account back in 2000 was a biggy. They'd then check to see what you have used your hotmail for (most used email account back then) such as web stores and things, then they'd have your address and personal details if they login to those too.
Some clever people out there doing it. And actually managing to get away with it for years too.
The link requests that you get will largely be automated. A 'bot' (basically software that is running on-going) will scan the internet for email addresses and web forms to click on / fill in, and send the same message thousands of times a day. Eventually they will end up with somebody linking to them.
Similar with the phishing emails. They'll scan the net and send dozens of types of emails. They really don't care what it is they send as long as it says 'click here to change your password as it has been breached' and yada yada yada. So they'll try for Lloyds, HSBC, Natwest customers and so on, as most people have a bank. They'll do ebay and paypal, as many people have those. And they'll just keep changing the wording a bit.
If you ever reply to one of these, even to swear at them or whatever, you are confirming that your email address is actually active, and their emails are getting through spam filters, so you will eventually get more of those types of emails as they know it's working.
I often find that a 'bot' is still existant long after the users has stopped collecting the data. Once a bot is started, they're hard to stop. They can automatically install on peoples computers, and they then use that computer to send emails, some emails will have the 'bot' in it and it keeps the thing living.
What security companies find out is that the controller of the bot has long given up but the bot is still automatically carrying on with its intended job.
A very dodgy world this internet if you don't know what to expect and are not so clued up.
