Got hacked and wondering if I've covered all my bases security-wise

So my teenaged son pissed off a hacker and then downloaded something he shouldn't have, and a RAT got installed on his computer. I received an e-mail from the perpetrator trying to extort money in exchange for returning various accounts and not leaking our info online. He included what info he had, which was our address, what banks I use with the last 4 digits of accounts and cards showing (other digits x'd out so I'm guessing he didn't get the actual accounts, just the info that would have been stored in Keychain?), and login info for various accounts. He did leak all of that briefly but it was deleted fairly quickly. Still, who knows how many people might have grabbed the info.

So, son's computer (Lenovo Think Centre M81 running Windows 7, and Kali Linux :/) has been offline ever since. I've actually taken the power cords and Ethernet cords to make sure he doesn't sneak back online in an attempt to fix himself as he thinks he knows all about hacking.

I changed passwords on: Router admin login Wifi network Every email account Every account of mine (including stuff like Apple ID), plus any of kid's attached to financial or personal info in any way Banking, credit cards, PayPal

I called my banks and they've put an alert on my accounts, but there's been no suspicious activity.

I use an iPad and/or an Android phone to access internet and there's no other working computers in the house. Separate from the issues with kid's computer, is there anything else I need to be doing to be secure as a result of this attack?

Thanks for any help or resources! Edited to add that I'm in Canada