I would need to know her Hive name so that I can see her recovery account (on Hive) before I can suggest any further action.
Many Thanks,
CA
Edit:
If it's in regards to https://hiveblocks.com/@evagavilan then her recovery account is Steem, and therefore, unfortunately, nothing can be done about it.
Many people assumed it was a phishing attack. It was not. She posted them in this comment (another reason why you shouldn't use your master password at any time except for recovery/owner ops):
Thanks for taking the time to respond. That's terrible. You mean she revealed them in a Twitter post?
If you can, please, dm me, @hlezama#3174 we have many questions.
👍