MFA is the most effective defense against credential-based attacks, as the stolen password alone will not grant access.
Any account using a password found in a public leak should be considered compromised. Change passwords immediately to unique, complex strings.
If you or your organization are concerned about inclusion in this or similar leaks: