Received a mail that my password for an app has been reset. Does this mean my GMail is compromised?

Question

Today morning I received a very troubling message in my inbox. I saw that there was a message that my account password for ZoHo has been successfully reset.

I don't remember making any such request that I had forgotten my password to the site, also there is no history of any mail that password reset link was sent to my registered email address.

I haven't used ZoHo in a long time and I went to check that what their password reset policy is via mail and I did manage to reset my password successfully through my mail.

Now this means only one thing, that someone had access to my email(Gmail) account.

Does this mean my account has been compromised? I use Gmail on my Windows desktop and my Android Phone. I also have 2FA enabled.

What can I do to find out if my email has been compromised and what can I do to protect against it?

Answer 1

Now this means only one thing, that someone had access to my email(Gmail) account.

I disagree with this statement. You are jumping to conclusions. I'd like to point out other possibilities.

1. They are taking pre-emptive actions to reset passwords. For example, if they know they have been breached, or they decided to look into the massive database of leaked password that has been circulating since December to see which of their user was affected.

For example in December Wordpress.com did that. They sent out emails with the title "Your Wordpress.com password has been reset". But they started their email with: "We recently discovered your login credentials in a list of compromised emails and passwords published by a group of security researchers.", and explained the situation.

2. Someone might have managed to convince Zoho to reset your password, pretending to be you and having lost access to your email account. In this case they could have bypassed the sending of the first email step altogether. Your Gmail account would not need to be compromised. This is highly speculative - someone would need a real good reason to go through all that trouble - but nevertheless a possibility.

3. It can be a mistake! A support tech miss-clicked and reset the wrong account's password. A developer wrote a buggy piece of code that found its way to production. Things like that happen...

Read carefully the content of the email, does it mention anything about why the password has been reset? Are you sure it comes from Zoho? Then contact them and ask what's going on.