Woke up to notification that my apple ID and phone number was being used on a new iphone

Check your device list to see if there is a device signed in that you don't recognize. You can remove the device using the steps in the article. below.

Apple ID device list -Check to see where you‘re signed in

As a precaution, you might want to consider changing your password and making sure it is a strong one. You can also add 2 Factor Authentication to your account for more security. If the attempts continue, you might want to consider a name change.

Apple ID has been compromised

 Apple ID Password Change

Note the restrictions in the article.

Apple ID Name Change

 What to do after you change your Apple ID or password - Apple Support     I suggest doing this before you change your Apple ID or password.

 Apple ID -Two-factor authentication

 Two Factor Authentification availability

 Apple ID - Using app-specific passwords

Apple ID - Two Step Verification App Specific Passwords

Apple ID - Two Step Verifications FAQ