Evernote was hacked, and they mandated a global password reset.
It's not surprising Evernote was hacked. As Schneier wrote a few days ago about waterhole and precision phishing ...
... Against a sufficiently skilled, funded, and motivated adversary, no network is secure. Period. Attack is much easier than defense, and the reason we've been doing so well for so long is that most attackers are content to attack the most insecure networks and leave the rest alone.
... If the attacker wants you specifically ... relative security is irrelevant. What matters is whether or not your security is better than the attackers' skill. And so often it's not.
Schneier quotes former NSA Information Assurance Director Brian Snow: "... your cyber systems continue to function and serve you not due to the expertise of your security staff but solely due to the sufferance of your opponents".
It's likely some of Evernote's 50 million customers are of interest to major opponents, so it's not surprising their defenses were inadequate .
I don't make much use of Evernote, but I did a password reset anyway. Which is when I discovered ...
- I was still using my non-robust 'evaluation period' password with Evernote. 
- I was using said weak pw with test data that included photographs of the children's passports and my old PalmOS notes
- I never purged my Evernote account when I decided not to use them (I went with Simplenote/Notational Velocity instead.)
- If data is in the Cloud, and you do not personally hold the only encryption keys, it is 2/3 public. Treat it that way.
- Clean up your services. If you aren't using a Cloud service delete the account or your data.
- Obviously, don't reuse important credentials, use a password manager (ex: 1Password )
- Use Google two factor for your most critical Google credentials, even thought it has an longstanding egregiously stupid security hole and it's still a PITA to use.
- Use iOS for mobile and OS X Mountain Lion for desktop.
- On OS X desktop do not use Oracle Java plugin or runtime, Flash or Acrobat.
- On OS X desktop run as a non-admin user and enter your admin password with caution.
- Buy OS X software through the App Store unless you have exceptional trust in the vendor.
- Don't use OAUTH or OpenID on sites you really care about. For one thing, a password change doesn't repudiate OAUTH credentials on most sites. For another, it introduces too much complexity and side-effects and it's too hard to remember which OAUTH provider goes with which OAUTH service.
- Do not rely on encryption solutions that auto-open on login. (ex: iOS screen trivial bypass bug). I use encrypted disk images with no keychain pw storage on OS X desktop for my most critical data and I use 1Password on my iOS devices in addition to a (currently hackable) screen lock code.
- If something is really, really, secret, don't put it on a computer and especially don't put it on a networked computer. (I don't personally have anything that secret.)
- Whether you're on the Net or on your own machine, remember Gordon's Five Levels of Information Affection  and manage accordingly:
 Among which antiviral software is worse than a snowball in Hell. At least the snowball will be transiently drinkable.
 An easy to remember and easy to break pw that I use for things I don't care about.
 The web UI doesn't support 'delete all notes', but if you create an empty notebook you can delete all non-empty notebooks, and associated notes, one at a time. Then empty trash. Of course the data will likely exist in Evernote backups for some time, possibly to be pillaged post-bankruptcy. Tags are not deleted.
 Note, however, the unanticipated consequences of strong security in cases of death, disability or disappearance
 aka Five tiers of data love, from Google's two factor authentication and why you need four OpenID accounts.
I: You want it? Take it.
II: I'd rather you didn't.
III: Help!! Help!!
IV: I'll fight you for it.
V: Kreegah bundolo! Kill!!
- Gordon's Notes: Gordon's Laws for software and service use 4/2010
- Gordon's Notes: Requiem for a gerserker - Gordon's Laws of Geekery 6/2009
- Gordon's Notes: Gordon's 4 laws of acquisition 1/2008
- Gordon's Tech: My Google (gmail) account is hacked - by ductus.com 9/2010 (I like to believe this was a Chinese hack :-)
- Gordon's Notes: Google's two factor authentication and why you need four OpenID accounts 9/2010. Since then I've become less enamored of OAUTH and OpenID, but those five levels of credential protection still work for me.