Change your password on all other sites that use your email address and password you used on giffgaff. Do not use the same password on more than one site;
If you have a spare (unactivated) giffgaff SIM card, do a SIM swap (activate new SIM whilst logged into your current giffgaff account. If you do not have a spare SIM and are in the UK, report your SIM lost/stolen here: https://giffgaff.com/support/lost
If your bank/credit card details were saved on your account, contact the card issuer and alert them to the potential of fraudulent activity on your account.