[QC] Desjardins Compromised Again?

I just got an alert this morning on my Desjardins mobile app that there was an attempt to access my account from an unauthorized device (Mac OSX 10.something, I don't own any macs). I selected that it wasn't it and locked down the account.

This is extremely concerning to me for a list of reasons

1. I use LastPass, so my Desjardins password is long and randomly generated
2. They use secondary security questions, which I don't have saved anywhere
3. I use my card # for login, which means my email addresses/usernames are not associated with the account

So I called them up, and the claim from the service agent is that the account was indeed accessed "successfully" except for being blocked by the unrecognized device.

So how was it compromised? I'm pretty sure my opsec is good, I only use computers I am the system administrator for.

Has Desjardins been compromised again? Anyone else have some recent stories?