Has your credit card been charged? Are you sure the message is legitimate? Does it contain a link for you to sign in somewhere? It may be a scam. Check your purchases history.
Purchase History Review
Check your device list to see if there is a device signed in that you don't recognize. You can remove the device using the steps in the article below. If you find one, change your password.
Apple ID device list -Check to see where you‘re signed in
Apple ID Password Change
What to do after you change your Apple ID or password - Apple Support I suggest doing this before you change your Apple ID or password.
Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address. The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple e-mails will never contain an attachment. Apple will never request personal information by email such as Social Security numbers, your Mother’s maiden name or full credit card numbers .
The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.
Avoid phishing emails, fake ‘virus‘ alerts, phony support calls, and other scams
Identifying legitimate emails from the iTunes Store
Send the e-mail to Apple as an attachment to a new e-mail before deleting it. You can forward as an attachment by going to Mail/Message/Forward as attachment. Or control - click on the email and select Forward as attachment. Make sure you send it as an attachment to a new email. If you just forward it, it will probably be rejected. You won’t receive a response.
reportphishing@apple.com
If necessary, contact iTunes Support. Either use the form or scroll to the bottom of the page in the 2nd link. Follow through the screens to get a chat or telephone option.
iTunes Support
iTunes Support – world wide