I cancelled all cards and did what i could for the finance company. putting a freeze or security on her investment account required her to have to go to a bank(or other official notary accepted by the firm) and verify her identity and then mail a letter to the company to authorize transfer. so all the accounts were cancelled/cards reordered but freezing her account would be a huge impediment as she makes transfers every few weeks to live. the cards/ect from initial breach i am not particularly worried about. but to your second point:

> The OS should also be reinstalled from scratch, after backing up any pictures or documents and reformatting the disk.

I removed both ram cahces and replaced them as well as the harddrive with another entirely reset windows 10 install i had laying around.

HOWEVER, she is reasonably tech savvy for 80 uses computer everyday, ect, but she was having trouble adapting and begged me to put win7 back on. I simply swapped hard drives back, so there has been 0 diagnostics run on the current drive except a single full system scan done by the microsoft virus program, although, again, she said they installed it (it does look like real MS) but maybe they just added an exception. I figured I would do damage control, and let her use current OS for now(told her not to do online shopping haha) while I try to assess full risk.