my professional email (the one I use with my legal name and stuff) got a phishing email today from an accounting firm in the UK

I checked the listed website and the firm and person’s names on it were real, so it seems like they genuinely got phished—but how did they get my email? it’s not like I’ve ever applied for jobs in another country

anyway, I forwarded it onto the main account on their website with a note saying that I received it so that they can know about it at least