u/Disastrous_Action_64

My parents clicked on a suspicious link and now there are emails being sent from their address with DocuSign.

They’ve also been notified from multiple financial institutions of password and contact information changes.

The original file was opened on a laptop, which I’ve started backing up files onto a removable storage device and have disconnected from the Internet and plan on factory resetting the computer. (I understand that this likely isn’t a permanent fix and we’ll get a new computer)

What additional steps should I be taking to minimize damage?