Don't just change passwords - as @kslo said in another comment below, change your root password! If you're not comfortable with that, then at least disconnect your device from the internet. Don't get me wrong - there's only a small chance that you'll be targeted. Just keep in mind that your device's contents are susceptible. This includes saved passwords, even if they aren't in the keychain.