Yesterday I received two (authentic) e-mails from Google saying they prevented sign-in attempts to two (very old) google accounts of mine. Google says they used the correct passwords, which turned out to be very old passwords that I had not changed, simply because I have not used these accounts in a very long time (more than 5 years).
This is the first thing that struck me as very odd. I had basically never used even used these accounts for anything. As far as I can remember, I may have signed up with them for an Apple ID, but let's move on.
The thing they did have in common for certain was the recovery e-mail.
Now, I wasn't going to ask a question about this here at first, because it's probably nothing that can be answered here.
However, today I was told by a relative that one of her (old and pretty much unused) Google accounts was also attacked with the correct password (around the same time yesterday). This account was likely setup by me for her and may be linked in one way or another to some of my Google accounts (either through exchange of communication or recovery email).
Neither of these accounts has been used in a while and was never used much at all
All of these accounts appear linked
I am not asking you to speculate about what happened here in particular, but is there a reasonable explanation of how those accounts may have been compromised?
My most likely explanation would be that another (linked) account got compromised and these e-mail addressed where extracted from there?
Or should I consider my personal computers to be compromised as this sort of information could technically have been extracted from there?
I am usually a reasonable cautious person, using a password manager, etc. and I already changed all the passwords to these accounts, but is it also considered good practise in this case to rebuild my personal machines?
I am looking for advice here, because I can't wrap my head around how those specific (old and very rarely used) credentials could have gotten leaked.