Unfortunately ECAF isn't quite functioning as it was envisioned before the mainnet was launched. The hacker will try to move your tocken to an exchange of his choice once it's get refunded in 72 hours. If you can prove your ownership pre-theft, contact exchange. ECAF will take weeks if best, which is likely to be already too late.
Here is my basic incident response plan if an EOS account I control is hacked:
Regain control of the hacked account by changing the owner/active key pairs
Identify all transactions if any that were done without my real authorization but with my active or previous owner key pairs
Contact block producers on the telegram channel @EOSProsto and get further ...
As I never did this, do I load my OWNER private key into a new wallet and then change the active key to something else to prevent the hacker from doing anything?
Or is there another step I do not know about?
If you want to or if you believe that the wallet you used may be insecure, you can generate new key(s) for the owner and reset your owner ...