The order that matters
Email account first — it is the reset path for everything else. Then banking, then anything reusing that password, then the rest. Turn on an authenticator app, not SMS, wherever it is offered.
Then stop the bleeding
A password manager ends reuse permanently, which is what turns one old breach into six new ones. It is the single highest-return hour a household can spend.
Takeaway. Run the free Breach Scan, then work the list top-down. Ninety minutes, once.