Sorry. I thought you are using QB Desktop. You and all your users must change the password. Then monitor your audit logs from time to time over the next three months for suspicious activity. You can also consider using an automation tool to notify you via email for each invoice generation and other specific events if required.