Reach out to every company fraud department that domain was used with and let them know the domain expired and is now being actively abused by criminals. There are whois history sites that can show you used to be in control of that domain.
Reset all of your authentication details with all financial institutions, ideally in person after showing them your state ID and let them know to block anything related to that domain. Have them treat your debit cards as stolen and issue new ones with entirely new numbers. Consider temporarily freezing your credit with the 3 credit agencies.
If the attackers are causing financial harm consult with an attorney and also with the FBI cybercrime division if you are in the US. [1] Log all details that you can including dates, times, events. Just the facts. Keep records of your communication with lawyers and the FBI so that you can show you were performing due diligence in for future related incidents.
[1] - https://www.ic3.gov/
