This was a phishing test.

That wasn't Microsoft, and it wasn't Enercare. It was a page a coworker stood up for today's town hall. The address was never a Microsoft or Enercare domain, and you entered your sign-in anyway.

Here's what the page captured — note it never stored your actual password:

Real attackers keep the password. The only defence is the address bar — check the URL before you type, every time.