Your personal data is part of a data breach by company A.
Company A sends an email apologising. You now get free data monitoring for the next year from company B.
You get an email from company B – the data monitoring company – asking you to enter your sensitive information so they can do the data monitoring.
You are now in a recursive loop.