i distinctly remember ea constantly doing this with origin accounts. Deepshits forced users to rotate passwords, but didn’t ever feel like notifying the user itself.