First thing you need to do is make sure your e-mail account is secure, ie, change password, keep it unique and never re-use passwords across sites because the first thing scammers do upon obtaining an e-mail address / username and password leaked from one site is try all the known major stores (Amazon, EBay, Steam, etc) with the same details hoping to get lucky. Definitely keep 2FA enabled.

Secondly, if you don't keep receipts of your games, then it's worth going into Username -> Orders & Settings -> click the down arrow -> View Receipt on a few games (including the newest and oldest ones you bought) and save / "print" a few of them to PDF file, and back them up with your personal data. Not just for GOG but other sites with accounts. That way if you do ever get hacked and contact support, you'll have some tangible proof of purchase, previous order numbers, dates of orders, etc, (that no-one else but the buyer should know) that you can e-mail support as proof that you are the genuine account holder to often make the account recovery process a lot faster. If you use Paypal, save a few Paypal PDF receipts of the same games as the GOG order ID is also on the Paypal receipt. The more you can give them, the more overwhelmingly obvious it looks like you're the genuine account holder. Most people tend not to think about this stuff until after they've been hacked, so it's worth downloading some proof of purchases for every account anyway just as a precaution.