A few weeks ago now I received an email that someone (not me) had made some in-game purchases on an iTunes account. I logged into my iTunes account and saw the transactions and that my account was some how joined to a family group account. Upon further investigation, the transactions were made using a different credit card that wasn't mine as they never showed up on my credit card statement (and the last 4 digits weren't mine). After an hour on the phone with Apple, I was able to get my account detached from the family group.

According to the Apple support, a child would need to accept an invitation to join a family group. I received no invite so the attacker was somehow able to circumvent that. 

The account it was linked to seemed to be fake. The contact information was somewhat random. The name was `sger erhs` and address was `rewahgewr`. The province and city and postal code was where I live (although the postal code was not exactly the same as mine). After talking to a friend, I found out the in-game purchases were for a game that can only be played in China so that is probably where the attacker lives.

Since no purchases were made using my credit card and they didn't gain direct access to my account, what was the attackers intent here? Did the attacker get anything out of this? Besides changing my password, is there something else I be doing to be secure?