I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons".

The policy for new passwords is: 6 to 10 characters, no special characters, no repeated characters, not case-sensitive.

My old password was much better than this. I used a random password generator.

I am not a security expert but this seems like a lack in a policy. Am I being overly paranoid? This is a business account.

Should I suspect that I myself was hacked?

Note: The ATM card number is not part of the bank's online authentication process.

Note2: I went to Password Meter and was able to cobble together some passwords that meet this criteria and that password meter deeemed "Very strong". Am I wrong to still be concerned?