My somewhat educated conspiracy theory is that companies do this when they know their user data has been stolen, but they don't want to go public with the breach.

Just quietly invalidate everyone's password so everyone is forced to update them, making the stolen data useless.

Bonus when you're using a password manager so it's guaranteed to be correct since you've filled it with that for years.

Reminds me of yesterday when I played Uno on the Switch against the AI. Blue was the color. One bot had to keep picking up cards until they could play. Finally they picked up a switch-color card.

They picked blue.

😐

I like it when they tell you the old one expired thats why it doesnt work. Why is it soo hard for some sites to tell me!

I got stuck an utterly embarrassing amount of hours on this the other day because I recently changed my password but managed to set it with a typo.

I know it is correct, I wrote it down in my password manager, what the heck is going on, have I bern hacked? Do I have extremely specific disk corruption?

At the end I was wondering if the password algorithm was hitting some dodgy hardware (ram, rdseed32...) and just sat numbly and entered the password over and over again to see if it behaved differently. ...and on one of those attempts I managed to do the same typo and the mystery was solved.

Because sysadmin is too damn lazy to just tell you they want you to change your password.

It's because it keeps track of either all previous passwords or like a certain amount back. So you definitely used that one at some point, it just wasnt the one you used now.