Same type of hack as OP. Was notified by Evernote of login from foreign remote IP (below).
We noticed a new login to Evernote and wanted to make sure it was you. Where: South Korea When: 2018-08-28 04:22 UTC
I did have a weak password, and did not have much in the way of docs at risk. Easy fix to hack, but they are out there.....careful on your passwords. Maybe multi-step authentication?