Mostly true but there things like Collection #1 and Anti Public Combo List which are amalgamations of unknown provenance. A lot of it is probably prior breaches but I wouldn't be surprised if it contained phishing data.