The only thing I can think of is that I accidentally went to a phishing site and gave them the information they needed to pull this off. I have no other explanation.

I am extremely careful but sometime I get rushed at work and may have done a quick google for the IDEX site and come up to a Phishing one instead of the real thing. I'm praying that this is what happened and I can just chalk it up to me being a stupid idiot.