To follow on from this, if you have somehow leaked your master public key, or someone else has accessed it, then I would recommend abandoning that wallet and transferring all your coins out of it and to a new wallet. Not only is it a big privacy invasion since the third party can derive and link all the addresses within that account, it is also a security risk. If the third party/attacker was to also gain access to a single private key to any of the addresses within that account, the combination of private key and master public key allows them to derive all your other private keys as well.