[justinludwig]

If this is her personal phone number, then it's likely available from any number of "legitimate" data brokers; plus likely would be part of various database dumps you can buy on the dark web. It's pretty easy for someone who knows what they're doing to spend a few minutes of research on social media to find several employees of a small company, lookup their personal contact info, and message them claiming to be the company's CEO.

To protect your employees, let them know that either a) you'll never call or text their personal phone number; or b) if you call or text, it will always be from a known good phone number (which they can put in their phone's contacts).