It’s not “for sure phishing” Discover does send emails like that. They have a service where they scan the internet for your personal information, and they sell you credit monitoring, and other stuff to reduce the impact.
Here’s a screenshot of part of their website for this monitoring.
Of course it’s ALWAYS a good idea to go to the website, and never click a link on an email from your financial institution, but I’m like 80% sure that this is a legit email.
Also, your SSN and other financial details have likely been compromised dozens of times, so just having your SSN floating around out there isn’t surprising. It’s a fault in the system for using an unsecured SSN as an identify instead of what it was initially used for.