People like to reuse their passwords.
So what happens is some of your personal details, including email and password have been leaked by a website. It could be new that nobody knows or a website that even went out of service many years ago.
Now they will try to use that email and password across hundreds or thousands of websites.
This is by far the most common way of getting "hacked".
You can check on haveibeenpwned.com or some other websites to see if your data was leaked and from where.
Some will try to find if your data was leaked by your email ID, phone number, address and even password.
The last one is pretty dangerous, as they could be able to identify you and link that password to you.
Beside there's the so called "honeypots", so you're basically feeding information to hackers rather than checking if your data was leaked.
Also installing garbage from the internet onto Windows is a very very common way of getting hacked.
Even here the so called computer technicians install cracked copies of software, games and Windows which could and most likely are infected and more vulnerable to attacks.
Some tips:
1. Do NOT reuse your password ANYWHERE.
2. Use unique email IDs. Either to safe guard your sensitive accounts or to use them in junk websites. Fastmail does a great job at this and integrates with 1Password when creating logins.
Gmail has something somewhat similar but not very useful since it's very easy to guess your email ID.
https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html?m=1
3. 2FA is a MUST for anything you value. Without it NOBODY can log into your accounts.
4. Get the recovery codes for any account you value. Print them or put them somewhere SAFE that you can trust. This is the last and ultimate resort to get your account back.
Do NOT make them obvious like writing what they're for or the email ID linked to it.
You could either keep it in a safe place online (which evidently isn't very safe) but encrypt it BEFORE you upload it. Or preferably offline printed or in an encrypted drive.
I'd highly recommend 1Password with SEVERAL hardware keys like Yubikey. Keep one at home so if you lose it you won't lose access to your accounts. However it will only be asked on new devices.
India is among the worst places to be for it as well, so take it seriously because the data for most Indians has been leaked from several cases. There's no such thing as data privacy or protection here, it's been years where cybercrime has taken a lead.
