Two-Factor Authentication

Okay so this morning I woke up to a notification from two factor authentication asking if I had tried to log into a device in some country I have never even heard of and asking me if I want to give it the log in code. Obviously I declined, changed my password and logged all devices out of my apple ID just incase. I know that I denied this attempt however I am wondering if it is possible that whoever did this got any of my information other than my old password and email address. Or if there is any possible way they could have actually gotten into my account even though I denied their access.