Chase alerted me that my Apple ID was found on the dark web - how do I treat this?

I got an alert from Chase credit monitoring that my Apple ID (email and password) were found on the dark web. Besides changing my password:

* What other appropriate measures can I take?
* Any idea how this may have happened? I use Wi-Fi protection and am very vigilant about phishing. Although I recently traveled abroad and used hotel WiFi.
* How do I take steps to avoid this in the future (understanding that it is generally unavoidable, but wanting …

apple apple id dark dark web id privacy web