I'm a software developer so aware of basic security issues. I use a popular music streaming service and a few months back signed up for their paid plan as I was enjoying the experience. I use the service as an app on my android mobile.
After several months of good service I started having network issues which made the app unusable, it would stop after every song. I contacted the support team and they weren't very helpful but did suggest clearing the cache, reinstalling etc. A day later I noticed that I couldn't log into the app and that I couldn't reset my password so the next day I contacted their support team. They told me that the account was now registered with a different email address and name but was still connected to my credit card. User was in a different country and I had received no notification of any account changes. They didn't seem surprised by this and didn't offer much advice other than reassuring me that my information was safe, which wasn't very convincing.
I've cancelled my credit card and dropped my subscription and changed my password to something stronger. I still have access to the app and I noticed there was a connected device which wasn't mine so have deleted it. A few hours later though this device reappeared. This was unexpected although it's possible that there were some cached credentials on that device I'd have expected them to be invalidated following the password change. After deleting the device again it did appear once more but hasn't subsequently.
Reason for posting is I'm not sure if I should be concerned for other services. I've changed my password for other sites I use commonly and enabled 2fa on my email. I've registered for so much stuff it's hard to ensure it's all covered. This kind of thing is so common it would be good to have a list of advice links of common stuff to check. I'm still not sure how my account was compromised but I'm thinking it may be due to using over unsecured wifi while abroad on business.