I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons".

The policy for new passwords is
6 to 10 characters
No special characters
No repeated characters

My old password was much better than this. I used a random password generator.

I am not a security expert but this seems like a lax policy. Am I being overly paranoid? This is a business account.

Should I suspect that I myself was hacked?

EDIT. The ATM card number is not part of the bank's online authentication process.

EDIT. I went to <a href="http://www.passwordmeter.com/">Password Meter</a> and was able to cobble together some passwords that meet this criteria and that Password Meter deeemed "Very strong".  Am I wrong to still be concerned?

EDIT. The passwords are also not case-sensitive.