Here is a straightforward look at this topic for Malachain.
Large websites are breached regularly, and lists of stolen email addresses and passwords are traded among criminals. Finding your address in such a list does not mean your accounts have been taken over, but it does mean the password used on that site should be considered public. The real danger comes when the same password protects other services as well.
Change the password on the breached site first, then on every other account that shared it, starting with email and banking. Use a unique password for each service and turn on two-step verification wherever it is offered. Watch for follow-up phishing messages that mention the breach, since criminals use the news to make their messages more convincing.
There is more to learn on this subject, and the linked website goes into greater depth. Treat this article as an introduction rather than the final word, and check any important decision against up-to-date, reliable sources before relying on it.
If you try any of these ideas, start small and adjust them to your own situation. What works for one person will not suit everyone, and it is fine to keep only the parts that help. Writing down what you changed, and what happened, makes it much easier to see after a few weeks whether the effort was worthwhile.
The most useful step is usually the first one. Pick a single suggestion, try it for a couple of weeks, and then decide whether it is worth keeping. Small, steady improvements last longer than ambitious plans that are hard to maintain once everyday life gets busy again.