You review login history across your key accounts, looking for anything unusual. One account shows a login attempt from another country.
You immediately change the password and activate two-factor authentication.
"Vigilance is your strongest defense."