security problem?

i just got a notice from Sucuri monitoring that someone in England logged into my “webmaster” admin account on WP 4.0 and promptly modified 2 plugins’ source files. There were 0 failed login attempts, and they somehow knew my very complex password that I was using. It is making me uneasy about the security of the new WP 4.0 please advise.