Did you reuse the password at any other site? Check your haveibeenpawned.