This seems to be the culprit email, a phishing email from "Agoda". And all I did was click a link.