Third party ****s

This company has all our details and keep sending us emails requesting us to update. One of their consultants even contacted one of our employees saying that we owe them money and wanted to send banking details for a deposit. How are they authorized to have all our details?