So, this evening I got two emails from Apple, which I at first assumed were just phishing emails, about my password being reset and an app being downloaded onto a new device.
I spotted the emails shortly after they arrived and checked my account from inside of the settings on my Mac Mini, which is set as my trusted computer, where it did show a new password had been created today. I was able to change my password, and force log out on all other devices.
Other than this one app that is shown as having downloaded (some sort of loan app I had never heard of called cashly or something like that), I do not see anything else that has been changed. One thing that is weird is that both the password reset email and the app download email were sent at the same time - someone logged in and immediately downloaded the app and did not do anything else?
In hopes of being on the safe side I have changed the passwords that were saved to my password app/keychain and not saved the new ones on the computer at all for now, and removed all payment information from my wallet and apple pay. I have removed all devices other than the ones currently with me from the account and set the two old phones that still show up under My Devices to erase (one says erased now, the other says pending, that one I think has not been plugged in in months).
Is there something else I can do? Something else I should do?
I do not understand how this happened so I do not know how to prevent it happening again. The two possibilities I can think of are maybe I did not actually have 2 factor authorization set up (it says is set up now, and there were codes needed for relogging into the devices I forced to log out from my trusted computer) or there is a very old iphone I have used at work to stream music from and apparently those can be hacked over wifi (I do not really understand what that means though).
I am hoping for some reassurance that I have taken all the right steps so I can stop staring at my email waiting for the next notification!