The first thing to do is contact support with this form. They should be able to help you.

I'm very sorry to hear that your account was taken. There's been way too much of that going around since Witcher 3 was launched.

There's info here:

http://www.gog.com/forum/general/increasing_login_security_recaptcha/post1

Someone else will have to help you if you have further questions (I've not been hacked *knocks on wood*).

Contact support as soon as possible, or send a pm to a blue one. That's the only thing you can do.

Also, read this: http://www.gog.com/forum/general/i_think_my_account_got_hacked_1/post19

I did contact gog support who asked me for the last for digits in my card, the last time I purchased something from them. I wrote them back with the info 10 days ago but they haven't gotten back to me despite extra emails. should i give up?

No don't give up, just wait a little more because GOG's support isn't the fastest (but the guys are nice!). It has been said that if you send multiple tickets to support, they always go in the back of the queue. A good move would be to send a pm to a blue one since it's an urgent matter; Click on the next link, hover your pointer over Ciris's avatar and select "Start Conversation".

http://www.gog.com/forum/general/i_think_my_account_got_hacked_1/post19

This is why gog needs more support and two-step authentication ASAP.

Vote for two-step here: http://www.gog.com/wishlist/site/twofactor_authentication_sms_security_2fa

good luck on recovering your account as fast as possible !
And ya voted for Haydens 2 factor wish - while i use generated random lengthy "safe" passwords from Keepass and feel quite "invincible" to random hacking it seems like more and more accounts get hacked here and without any 2Step it's just too easy for the hackers and well it makes people lose trust in the safety of this platform which is really bad for GoG (a person who owns 1-3 games here and gets hacked and then has to wait 4-10 days until account can be recovered is quite unlikely to return/buy more stuff here)

Just don't feel too safe. You may then ignore some risks.
I am always uneasy about having all the eggs in the same basket. What if my HD crashes? What if my important files are deleted? What if I forget the master password?

If GOG goes through with 2-factor authentication, I hope they will make it optional.