One of the banks that provides identity theft monitoring to accountholders notified me that my email address was included in a recent data breach, along with a password, but without any indication of where this email and password was used. I asked if they could provide the (already compromised) password so I could find the affected account in my password manager, they said they didn't actually have the password included in the breach (huh?), and recommended I change the password on my email account. I don't see how changing the password on my email account will counter the compromise of an unknown account.
What's the basis for recommending resetting my email password when an unknown account password is compromised?
This is the entirety of the information in their alert:
Their response to my subsequent inquiry looked like a form letter and didn't answer my question, and included this recommendation:
If you have any affiliation with the website listed in the alert details as the source of the data breach, you should change your account password for that website, and also any of your other passwords that are the same as that password.
If you do not recognize the website listed in the alert details as the source of the breach, then you should change the password for your email account, and also any of your other passwords that are the same as that password.
Which is unhelpful because there is no website listed in the details. When I asked why they recommend changing the password for my email account they did not respond.