The email was from a law firm I have some dealings with. It said there was a document and needed me to log into Google. It was elaborate, and I fell for it. They got my Google password, and account history showed a login from Chrome on Windows, in spite of two-factor authentication. I didn't figure it out until the next day when the firm sent out an email, about 14 1/2 hours later. I changed my password immediately and logged out of the unknown session. Nothing seems to be missing or added. I already have two-factor on any sensitive accounts. What else do I need to do?