Stupid Internet Security Question

[Catbert]

I just noticed that my e-mail got "hacked" a week ago.  By "hacked" I mean that an e-mail  went to all my contacts with a generic note (something like, "I think you'll find this interesting") and an e-mail link.  I found it in my spam folder.  This has happen before on a different laptop.

I logged out of my e-mail and turn off my computer.  Then using another computer I changed my password.  It was (I think) a pretty strong password - 10 characters, lowercase, capitals, numeric, and no actual words.

How dangerous is this "hacking"?  Is there something else I should do?  Should I be worried about other passwords/accounts on my computer (e.g., credit union, credit cards, brokerage accounts)?  Non have the same password.   

I'm a non-techie in my 60s so please keep any responses as simple as possible.  Pretend you're explaining sex to a 6 year old.  ;-)   

[halfshellmeijin]

My guess is they got your password from some sort of phishing con. Changing your password is probably all you needed to do. Also, good with the upper lower and numbers on the password, but you can try that with full words as long as they are unrelated and not a phrase. Like maybe DrainPeg16HillsGhost. Makes it a long password and easier to remember as there are only 5 parts (four words and a number) opposed to 10 parts.

[forummm]

You should be OK now. Make sure you don't have a virus though. You can get free virus software like Avast if you don't have some already.

[gimp]

There are a few likely ways they got this information:

- Through a virus on your computer
- Through a phishing campaign, where you clicked on something because you thought it was official
- Through a social engineering attack; in other words, they got it from you personally because you told someone
- Through an attack on some other website, likely where you used the email address and the same password
- Through sniffing your wireless internet traffic if it has no password and goes over an unencrypted channel (http versus https, make sure your email is accessed through https if you use a browser; eg, gmail.)

#3 is pretty unlikely, though do note that if you share the email account password with anyone, they could also have fallen to the same thing.

What to do now:

- If you're using gmail for example, you can make sure to log everyone else out of your account who might be using it
- Change the password ASAP, to a password you never use anywhere else. A simple strategy is to use a phrase, for example, "ILikePuppies" or something. Another is to use a randomly generated string, "A0$gub88zi". You can imagine which is easier to remember.
- Scan your computer for viruses using free anti-virus software. Microsoft provides decent free software on windows 8/8.1, included in the OS by default. Viruses, trojans, keyloggers, malware of all sorts can grab your key inputs or internet traffic.
- Speaking of which, ensure that your wifi, if you are using it, is password-protected.
- If any are found, delete it... and maybe change the password again.
- Change your bank passwords as well, again, make sure they are unique and strong. Otherwise, they may use your email + password to access bank accounts.

Shit happens. You'll be fine after you do this, unless someone has personally picked you out to mess with (chances of that are approximately zero.)