How could Instagram and Shutterstock accounts be hijacked?

Question

Burglary protection

Today we changed the mailing addresses on these two accounts. Insta sent a notification with the ability to reverse the changes, so the account remained. Shutter was stolen irrevocably and they tried to buy charts for 200 bucks - a notification came from the bank that this operation was blocked (because the old card was used on that account, but I could not even imagine that banking data was stored there)
How could this happen? What should be done to prevent this? The passwords are complicated, the licensed Kaspersky Total Security works on the computer.
UPD: Shutter's technical support quickly responded and reset the password, and also deleted the bank data from the account. Well done, thank you. But I still don't understand how it happened and how to cover myself.

Answer 1

if the passes are unique for services - this is one thing
if they are the same - another
good principle is to get used to the incognito mode in cash, or even to the tablet