[sangd]

For the past year, I've been getting random calls and texts from a lot of unknown sources. Many times the callers even spoofed different numbers. And sometimes people call me because they said I called them. I suspect phone user information has been leaking probably in many different ways.

[bigwavedave]

Those are likely simple robo scam calls. Robo dialers call an absurd amount of numbers on various schedules in something of a brute force social engineering scam. To keep their dialers from getting permanently blocked or reported easily, they spoof the caller ID (usually with an area code similar to the recipient's area code in the hopes that someone will be more likely to answer a call from an unknown number if they think it's local), which is why you will sometimes get texts or calls from people who ask you to stop calling them. These kinds of people are just other recipients of spam calls and your number happened to be the number the robo dialer was using as a spoofed caller ID for them; that kind of thing doesn't really have anything to do with leaked info.

[akira2501]

This is the benefit to holding a phone number for an area code that's far away from where you live. I can spot and ignore those calls easily.

[sangd]

How about in the cases that they have personal info in sms messages or voicemail? Info got picked up from somewhere?

[bigwavedave]

For cases like that specifically, it's probable. But those are just like the scam emails where they say "hey, I know your password is ${OLD_PASSWORD}, I recently hacked your account on a popular 'adult recreation' site, remotely put Spyware on your computer, and recorded you 'entertaining yourself' while browsing videos (you have good taste lol). Send me x bitcoins or I'll email this to all the email and linkedin contacts my spyware found in your computer."

It's just an old password found in a breach years ago, they don't have anything else that's real. The difference here is that if they call and leave a voicemail with personal info, go to the police. They're not gonna bother tracking down a social engineering email, but they may be more inclined to go after verbal blackmail.