If you had a passcode on the phone, your data was safe even before you erased it -- but erasing doesn't hurt.
The main thing I would be aware of at this point is that thieves sometimes send messages pretending to be Apple trying to get you to respond and log into a site that appears to be Apple and by doing that divulge your Apple ID password. The message may, for example, indicate that your phone has been located. They primarily do that so they can turn off activation lock and sell the phone. But if you divulge the Apple ID password they would also have access to any data synced or backed up to iCloud.