The Lusha GDPR Request went through and now I know where they got my private phone number from: it's
L.S Mobile Apps Holdings Ltd
https://www.lsmapps.com
Which looks like unsuspecting apps but if you check their privacy policy and business registration, it's a data broker (again), explicitly sharing data with Lusha.
Down the rabbit hole we go, let's see where they got my private phone number from 😬