The main sources of PII breaches include phishing attacks that trick users, insecure APIs or databases, lost/stolen devices, accidental insider leaks via email or misconfigured servers, unauthorized insider access, and third-party vulnerabilities.