Weird Notification from My Cloud Storage About Device Authorizations—Is Something Fishy?

So yesterday I got a notification from my cloud storage service saying that a new device was authorized to access my account. The catch? I haven’t logged in from any new devices recently, just my usual laptop and phone. I double-checked the device list in my account settings and saw an unfamiliar device with a location that’s not even close to where I live. I immediately changed my password and enabled two-factor authentication, but I’m still uneasy. I also scanned my laptop and phone for malware but found nothing suspicious. My main worry is whether this was a phishing attempt or if someone actually compromised my account somehow. Has anyone else experienced this kind of random device authorization alert without having logged in from anywhere new? What steps should I take beyond what I’ve done to make sure my account is truly secure? Also, how reliable are those device location tags - could they be spoofed or inaccurate?