I got an email today about an account I have not used much recently. It told me of a new login, and then a new email about my primary email address had changed.
Now, first thing, I know a lot of you are using phones for internet, but the nice thing about using a real PC is you can hover over links to see if it is indeed the correct link (i.e. Microsoft isn't sending you to
paswordstealer.cn
instead of microsoft.com ). Using a phone, it is harder to verify where you are going to go if you click a link...so be aware of that too - there is a LOT of phishing out there.
Anyway, I was able to reset the email back to my email account, got in touch with support, and regain the account in fairly quick order. It isn't something that critical (a game account), but it could easily be bad.
If I had used the same password for multiple accounts (especially my email), there would be the real possibility that the hacker could have access to anything linked to that account, or to try and get into other accounts. Since every service seems to constantly spam you, anyone who now has access to your email could know where you have accounts, intercept anything like updated email addresses/passwords/password resets, and wreak havoc in your life.
Be sure that - if absolutely nothing else - your email account(s) and financial accounts use a totally different password from ANY other accounts you have now or ever have used. If you have the possibility of using 2 factor authorization, DO SO, especially for banking accounts or anything linked to bank accounts (paypal, ebay, etc). It usually involves a 4-6 character code sent to your cell phone via text that you must enter before logging in or when doing certain activities.
Don't use dumb passwords that are easily guessed. I sincerely hope no one here uses 123456, password, or their full name as a password. Use a gun name and serial number/year, or use a phrase, or use the name of something always on your desk, or anything else not easily guessed, add in a symbol and number or two, and you've got a password. If you are forgetful, perhaps use a similar format (change a few things for each individual site) if you must. And if you are really forgetful, write down a HINT, not the password itself.
If your password is "Mosin~1937Nagant", I'd think a written hint like "Russia '91" would be a decent hint that would be meaningless to someone else
If your password is "IHateMyNeighbors@5", perhaps "noisy dogs" would be a good hint.
Back many years ago, someone I knew asked me to see if her account was secure. It took about 5 guesses before I was into her account. (I mean, it was a yahoo account, but still, I guessed her password based solely on knowing her name and how her account name was displayed.) There is a lot of information on you out there. Don't make it any easier for someone to screw you. If the potential payout is good enough, someone can and will try.