Change email password just to be on the safe side. Make sure no device connected to your local internet is compromised. Give a Malwarebytes scan to your PC and look up your IoT devices (if you have any) to see if they had any history of vulnerabilities.
Do NOT use same passwords on multiple sites, or at the very least, salt your password based on the site. (add characters based on what site you’re visiting). For maximum security, use a password manager like KeePass.
Do NOT use a similar password to your very crucial passwords (your email, goverment sites etc.) anywhere no matter what.
Inform macys about your account being compromised; if your credit card was charged; issue a chargeback.