I worked for a firm where I ran HR. Found out they're using my log-ins to transact-my private security altered. Recourse?

The log ins are not email. They are banking and pension sites, maybe more, where there are private questions and security levels. Looked like they just somehow changed the password so I can't get in, but didn't remove my user ID from the site, like they are supposed to. I.E. Not being taken off as a signatory, but someone else transacting as me, with access to my private security, by just changing the password.