Just been phished, what do I do?

[landwhale]

Just had a company email containing a document, am expecting a document from this person and was just titled 'private and confidential'. I opened it, which took me to my drive so logged in.
No doc there. A minute later I get an email from IT saying do not open.

I gave them my email address and password (as it was google drive and gmail so same login).

I have changed my password and emailed IT. Checked no emails have been sent from my account. What else can I do? Feel stupid :(

Don't feel stupid, it happened to me once and my husbands colleague. We are all just trusting, not stupid.
Just change all your passwords. Combination of letters and numbers, ideally nothing similar to the old one.
Its a horrible feeling to know that we've been targeted.