That's part of it, but then there is also phishing. I get at least 5-10 phishing emails on my corporate email account, suggesting that my "PayPal account has been limited" or that my Wells Fargo account "has been compromised", asking me to click on a link and "log in" to my account. Those who click on the link and provide their login info are often the ones whose accounts get compromised.