Given that you are using two-factor authentication, Check your Apple ID device list (https://support.apple.com/en-us/HT205064) and remove any device that shouldn't be signed in using the steps in the link.
If there are none that shouldn’t be signed in, then you should not have a problem at this point. But, if an unauthorized device signed in, Change your Apple ID password https://support.apple.com/en-us/HT201355
Here is What to do after you change your Apple ID or password https://support.apple.com/en-us/HT204071
And see these security-related Apple Documents:
If you think your Apple ID has been compromised https://support.apple.com/en-us/HT201303
Security and your Apple ID https://support.apple.com/en-us/HT201303
iCloud security overview https://support.apple.com/en-us/HT202303
Ways to keep your information safe on Mac https://support.apple.com/en-gb/guide/mac-help/mh11402/mac
Using app-specific passwords https://support.apple.com/en-us/HT204397