Had a similar intrusion from a German IP early this morning. See my post here:
I’ve also changed my password and disabled remote access for now. However, I can’t see any activity that the hacker “Logged in as me”, just that a user I don’t know got added as a Shared User to all my libraries. They don’t appear to have streamed anything otherwise I’d have thought I’d see that in my Tautilli history (I do have the plex server log at the time of the intrusion though, so I have their email address and an IP)
