Use the service's official account-recovery process rather than people offering unofficial recovery services.
Secure the email address and phone number connected to the account.
After recovery, change the password, review active sessions and connected apps, and enable multi-factor authentication where available.
Check whether messages, photos, payment information, or personal information were accessed.