Recently my account in a social network has been attacked. The attacker managed to break the password, but thanks to the 2-factor auth, that wasn't enough to access the account. I have received a notification of an auth attempt and a one-time password
My password that was broken was pretty thick - it was long and contained letters and digits, there is no way someone could just guess it, so all I can think about is bruteforce. I have already changed the password, but it was used on some other websites, too, and that somewhat bothers me
I know that users' passwords are stored as hashes in websites' databases, and that hashes have such thing as collisions - when two different strings have the same hash. So it may be possible that the attacker didn't actually brute my actual password, but just some string which has the same hash as my actual password
My question is: what is the possibility of that? Does the fact of the password break necessarily mean the attacker now knows my actual password?