Security Breach and credentials Phished

We had a security incident with a staff member tricked out of their authenticator - then a sign in from overseas which generated a SharePoint page and sent out Emails to invite people to the page. Stopped it fairly quickly but we notice the hacker also looked at the breached users mailbox and forwa