<...>That's probable but in my case, I don't register it with any ICO, airdrop but I have it registered on an exchange. Is it possible that someone from exchange is leaking our numbers?
It could happen if an (ex)employee has access to customer records and can make a copy of them to sell at some point for shady business. If it becomes obvious and thinks can be traced back to him hed likely have a law suit shot up his back side.
If things are set-up correctly, no employee should be able to export records in mass, but its difficult to ensure that for those that work in IT directly against the databases.
On another scale of things, I often get call from companies trying to scam me for some service or other. They do it in English, and specifically make it about computers. That is abnormal for a random call, since I live in a non-english native speaking country, and Ive always thought that the source must have come from an official computer registration procedure whereby the subjacent database was stolen/leaked/sold (year ago).