I've been getting more and more demands to answer my secret question or sign in with codes sent to my alternate mail or cell when signing in with various sites. Yahoo never just lets me in and gmail is hit or miss. Not that I mind the extra security. Gmail just revealed that 5 million authentic gmail addresses with passwords were published on a Russian website. It can happen anywhere, but Russians seem to be responsible for more than their share of criminal web-shenanigans.
None of my several gmail accounts were hit, at least not in that dump. Still, I'm wary enough that I use always-on VPN and hushmail for more personal stuff (my own domain name, not hushmail).
I know. It's not 100% secure. Nothing is. I just notice that these extra security checks have been happening with greater frequency over the last year.