Good first stop I send people after a data breach: freeze, monitor, document. https://www.identitytheft.gov/
