I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons".

The policy for new passwords is 6 to 10 characters No special characters No repeated characters

My old password was much better than this. I used a random password generator.

I am not a security expert but this seems like a lax policy. Am I being overly paranoid? This is a business account.

Should I suspect that I myself was hacked?

EDIT. The ATM card number is not part of the bank's online authentication process.

EDIT. I went to Password Meter and was able to cobble together some passwords that meet this criteria and that Password Meter deeemed "Very strong". Am I wrong to still be concerned?