Unknown IP was added to IP access rules

Today I want to show clients how to allowlist IPs, so I login to my Cloudflare account.
Security → WAF → Tools → IP Access Rules
I saw 19 IPs was allowed to All websites in account:

They belong to different hosting companies.

Does it because I enabled something?

Or my account was hacked?

It looks like it. Please follow the instructions in the link below and make sure to also review the security of your email account(s).