Attackers gather personal information through various means, including social media profiles, public databases, leaked data from previous breaches, and even through direct interactions or reconnaissance activities targeting individuals or organisations.