Enable two-factor authentication on your Google Ads Account straight away. Google offers it’s own free authenticator app for download on your smartphone to help you with this. I would go further and say that two factor authentication should really be enabled on your entire web presence (Facebook, Email, Personal accounts, Web Admin accounts etc).
Web users can really assume at this stage that passwords alone are not enough to be secure, even strong ones. Dark web sites are openly advertising millions of passwords and the chances are high that your username / email with password is on some list somewhere.