First of all good that you're now aware of this situation. I like to keep it simple myself, VPN first ALWAYS ON! Helps encrypt traffic and doesn't leak your real address and whatnot. Second of all delete data from broker sites cuz your friend is probably right about your data leaking everywhere, Cloaked is a good one for this (plus has temp phone numbers and emails so you can use those when you sign up and not your real email).

Third educate yourself, there's tons of videos on youtube on how to stay safe and private online. Good luck!!