I'm sure everybody knows the e-mails that many web services send out when you log into your account from an unknown device or geo-location to inform you about suspicious login activity.
The problems start as soon as one doesn't attempt the login him-/herself and this mail could actually indicate that some adversary tried to access one's account. This happened to a relative of mine about a month ago with their e-mail, their Facebook and Steam account. All pretty much at the same time. The Steam emails even suggested that the attacker was in fact able to log into the account.
We immediately took action by changing passwords for most of their internet accounts and (finally) activating 2-Factor Authentication where possible. But, over the last days, Facebook reported multiple failed login attempts again.
As far as I can tell, all the mails that were received were genuine. The links in them pointed to the real websites and they (especially for the ones from Steam) looked like the real deal. So I assume that there were in fact multiple attempts to break into the accounts (and maybe even a successful login in case of Steam).
What steps can we take to prevent these hacking attempts in the future? Or is it only possible to minimize the success rate of such attacks by choosing strong passwords, 2FA, etc.?