CourierIt not protecting customer personal information asd required under the POPI AQ ct?

Why have I received a phishing email (from: ***) advising me that "CourierIT informs you that your shipment number ZA000152A20 is waiting for your instruction . You must pay customs fees to complete the shipment". Given tracking # produces "Cannot Locate Details For Waybill Number - ZA000152A20!" But why do I receive it? Where does sender get my email address from? What does this say about your protection of customer's personal information? What does this say about your observance of the requirements of the POIPI Act? Why am I exposed to potential ***** risk because, apparently, you can't exercise the legally obligated protection of my information as required by the Act? PS: It appears that you have been targeted by a syndicate. I say this because I have also received a similar mail, purportedly from Postnet, also quoting the above shipment #