Apple

My boyfriend and I have never shared the passwords for each other's Apple ID, and neither of us has logged in with the other's phone. However, we have the same family plan for iCloud+.

Yesterday, my boyfriend mentioned that he had recently received messages related to my passcode, stating that I am at a high security risk due to using the same passwords for multiple websites.

He also mentioned that he was able to see all the passwords for every website I have logged into.

Why is this happening, and how can I stop it? This is stressing me out, and I desperately need help!