Updated
Quick fix
Use a password manager, give every account its own long password, and turn on multi-factor authentication (MFA) for email, banking and anything with customer data. Start with your email account.
Step by step
Start with email
Your email can reset every other password, so protect it first.
Use a password manager
A reputable password manager creates and remembers unique passwords for every account.
Make passwords long
A passphrase of several random words is easier to remember and harder to guess than a short complex password.
Never reuse passwords
When one site is breached, attackers try the same password everywhere.
Turn on MFA
Use an authenticator app or a security key where possible; text-message codes are better than nothing. Many services now offer passkeys, which are even safer.
Save recovery codes
Store backup codes in your password manager or a safe place so you aren’t locked out if you lose your phone.
Remove old accounts
When an employee leaves, disable their accounts and change any shared passwords.