I think it's both and it's very disconcerting. Large non msc get hacked and some of them offer credit monitoring services. I suspect msc computer systems don't have the high backup and security of established companies.
@RockinRita03 - It sounds like you may have cashed the check. If so, contact your bank ASAP to let them know about this because the check will not clear.
Here is what the FTC says:
Don’t deposit a check and wire money or send money back in any way. Banks must make funds from deposited checks available within days, but uncovering a fake check can take them weeks. If a check you deposit bounces – even after it seemed to clear – you’re responsible for repaying the bank.
Genius idea.. Although now that I look at it, it definitely isn't theirs and it should've been an immediate read flag. Contact name is Thomas Gibson and the email is firstname.lastname@example.org.