A couple of my Google accounts have gotten the following message:

-------------------------------------- 
Hi [username],

Someone just used your password to try to sign in to your Google Account
[username]@gmail.com, using an application such as an email client or
mobile device.

Details:
Wednesday, November 30, 2016 8:32 PM (Central Standard Time) Illinois, USA*

Google stopped this sign-in attempt, but you should review your recently
used devices:
-----------------------------------

What does this really mean?

How could that person/entity get my passwords? IOW is there some basic
security practice I'm missing? Don't they need to be able to access to
one or more of my computers/smartphones to get passwords?

Thanks.
--- NewsGate v1.0 gamma 2