You contact your friend's bank to lock all accounts associated with the breach.
The bank acts quickly, freezing the accounts to prevent further unauthorized transactions. However, your friend must work with customer service to get access restored.
"Some battles are won with patience and persistence."