Don't make a new Apple ID if you have any purchases from the iTunes/App/iBooks stores. Purchases can't be transferred from one account to another so if you want to retain access to that content, you'd have to keep the original Apple ID around anyway. So why set up more hassle and confusion by now having two Apple IDs? Hackers need two piece of information to log into your account, your email and your password. Obviously change your password. You can confuse them even more by changing the email address associated with your Apple ID. You can only do this if the email used on your Apple ID is not an Apple provided address (i.e. not an iCloud.com, me.com or mac.com email). Adding two factor authentication beefs it up even more because now they need 3 things, your email address, password and access to one of your trusted devices. As mentioned above, you must secure your account before ever thinking about turning on two-factor. And after major changes to your account, there is a 3 day holding period before you can enable two-factor.