I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons".

The policy for new passwords is 6 to 10 characters No special characters No repeated characters

My old password was much better than this. I used a random password generator.

I am not a security expert but this seems like a lax policy. Am I being overly paranoid? This is a business account.

Should I suspect that I myself was hacked?