[mothered]

I use different passwords on all sites

This.

Members who read the above, please not only take It under advisement, be sure to put It Into practice. The same applies (where applicable) with usernames. Create a different username for every (online) account. Both credentials need each other to authenticate the login, so the strength of the username Is just as Important as the strength of the password.

Users predominantly focus on complex passwords, but If the username Is known to the attacker and there's no other form of authentication on the account (2FA, 2 step verification etc), the account Is 50% compromised already.