unautorized access

This weekend one of our biggest events disappeared from our calendar the day of the event. Fortunately the customer had a duplicate lead in the system with original items that were later adjusted so I could at least recover the log and CRM. Our log showed that at 6:45am Saturday I made a updated the Lead, Not only was I asleep at 6:45am (a bit unusual for me) but the IP adress assigned to the update was not one either I or anyone in my organization recognize.

I did an IP search for the IP and found it originated 60+ miles away from my location (although we know these geos are approximate and can be vague at best) It was a Cocast customer, as am I, and I am told that given the time stamp and IP address in our log, Comcast should be able to identify the source of the action that deleted my customer)

This is not the first time this has happened. I have recognized similar activity 3 times in the past year. I am inclined to chnage passwords, affecting many of my third party services. But I am asking for advice and opinions from our colleagues. I am concerned that I have opened my door to people I should not have.