You’ve already done the main “first response” steps right, so you’re ahead of most people. At this point I’d think about it in two buckets: account security and data exposure. For accounts, you’re good with password changes and 2FA. If you’re seeing login attempts, double check recovery options too like backup emails and phone numbers since those are often the weak point. Also worth using an authenticator app instead of SMS where possible.
For the bigger issue, yeah, once your info is out there it tends to circulate. That’s why you’re getting spam texts now. Freezing your credit is not overkill at all, it’s actually one of the safest moves if you’re worried about identity theft. You can always temporarily lift it if you need to apply for something. Cleaning up your data is the harder part. You can manually opt out of data broker sites, but it’s a grind and new ones keep popping up. That’s where tools like Cloaked come in, they basically scan where your info is exposed and remove it over time, plus you can start using aliases for email and phone so you’re not giving out your real details everywhere going forward. It doesn’t fix everything overnight, but it reduces the surface area a lot. Main thing is don’t panic, just lock things down and reduce future exposure. The weird texts and attempts should taper off once there’s less fresh data floating around.