How exactly do you know you weren't? They won't send a notice in your email. It could be someone you know.
1. Social attacks almost always involve getting the password reset. Usually they've also compromised the attached email account as well. That did not happen. I was able to regain control of my account with minimal damage because the password wasn't changed. But let's assume for a second I
was social'd. Does that mean impostors can convince MS to give out passwords over the phone or in an email? That's even more disturbing than MS being hacked!
2. Someone I know? I don't know anyone in Eastern Europe who has tried to wheedle my password out of me (let alone succeeded).
3. Actually, phishing does usually involve an email. I don't follow links in emails to log in to services. I'm also not so foolish as to believe a suspicious offer of free MS points.
As far as I can tell, my account was compromised in one of four ways. My password was originally a shared, low security password used when I created for Games for Windows Live. I made the mistake of not upgrading it to a stronger, unique password when my MS Live account became associated with my gamertag and a credit card ended up attached to it. So it's possible the password was stolen from a third party and used to access my Live account. For the record, the password was not exposed in any of the recent high profile hacks, including PSN and Gawker.
Second, a virus or other piece of malware infected my computer and logged my credentials. If this was the case it has never been detected by AVG or Spybot and the information gathered has never been used to compromise any of my other accounts (paypal, amazon, google, my bank...).
Third, my password was short enough to have been brute forced. This would require a flaw in Microsoft's security apparatus that is supposed to detect and prevent such attacks. But the password, while alphanumeric and considered relatively secure when it was originally created, was only 8 characters long and should be breakable.
Fourth, there is an undisclosed or undiscovered flaw in Xbox Live's security that allows hackers to discover a password or hijack an account without needing one.
