Quite. I had an elderly lady I support who was mortified by the email, could barely bring herself to tell me about it but was clearly concerned because she did recognize the password it contained. I managed to reassure her about the lies, identify the source of the breach with https://haveibeenpwned.com/ and got her to update all her passwords.
tt2