Picrel. I will never provide personal information but I need to know what steps to take next.

We reset the gmail password but they might try to compromise again. The phishing happened on a chromebook so only a gmail account was affected. But the person owns a windows pc as well and likely did not open the email on that pc yet. Also, they revealed that they use the same old password on almost all of their accounts.