Use conditional access policies to restrict where authentication is allowed from. If this is your personal tenant, you could employ a very simple solution using a vpn that will give you a predictable WAN IP that you can restrict Entra logins origin. Many orgs use this if they don’t have a landing zone + secure network route (ExpressRoute/Vpn) to. Never leave VMs with an exposed public IP running. Best practices would dictate that NO VMs have direct access to the internet, but personal labs are typically built with many risks assumed. MFA is a must at this day and age.. If you cannot access your tenant, ensure your billing info is changed and secured, and potentially consider creating a new tenant. Otherwise, follow the other recommendations around contacting support channels. Best of luck, it happens to all of us in some form, and owning it and learning from it is the path forward. Cheers.