Most likely this is a scam. Don't fall for it. Apple will never send you a message that your passwords have been compromised.
In order for there to be any potential possibility that this phone was hacked, all of the following would have to be true:
- The hacker would
- need to know your Apple ID username & password.
- need to know your iPhone's passcode.
- have to have your exact fingerprints for Touch ID.
- have to look exactly like you for Face ID.
- have physical possession of your phone.
The only other thing would be if you have jailbroken the phone.
You should, as a minimum, just change your Apple ID password. It is totally up to you, if you want to change any others. Actually, it is a good idea to consider the following four things when it comes to passwords:
- Use strong passwords.
- Never use the same password for different accounts.
- Change them every 30-60 days.
- If an account allows for two-factor password authentication, enable it.
Ref: