Given the history of data breaches, my first thought is that this could have been a scam. For anyone else in this position (esp. if you’re fairly certain it’s not a scam), here is some info on what you can do: https://consumer.ftc.gov/articles/fake-abusive-debt-collecto...

Edit: namely, this part:

> your debt collection rights, including your right to get information about the original creditor if you ask for it within 30 days of getting validation information from the collector