Hacked, ad account drained ($1,180), then disabled. Got it back + the money refunded. Long, sorry

Food truck in Tampa. Here's my whole saga from the last 5 weeks in case it helps anyone with a business account. Aug 2: Got an email saying my login email was changed. I was slammed at a festival and ignored it (mistake #1: that email has a link to undo the change, USE IT). Aug 3: Locked out. Someone was running ads from my ad account, $1,180 in under 2 days on stuff I'd never sell. Aug 4: Facebook disabled my account, probably because of the hacker's ads. The truck's Instagram went too. What worked: 1. Bank first. Called my card issuer, reported the ad charges as fraud, cancelled the card. They opened a dispute and refunded it in about 3 weeks. 2. facebook.com/hacked from a laptop I'd used before, picked 'someone else changed my email'. Did the video selfie. 3. Filed a police report (non-emergency line) and an IC3 report online. Mostly for paperwork, the bank wanted a report number. 4. Waited. Did not make a new page. Did not answer any 'Meta Business Support' messages (got 3 phishing ones, they look very real). Sep 6: Got a 'your account has been restored' email. The hacker's ads were gone and my old posts were there. Instagram came back the next day. Now: authenticator 2FA, a new email used only for the business, and a virtual card with a low limit for ads. Hope nobody needs this, but here it is.