The 3-2-1 rule — three copies, two media, one off-site — survives ransomware, theft, and house fires, and it costs from nothing to a few dollars a month to implement.
Phishing emails impersonate brands, bosses, and banks to harvest logins or push malicious attachments — six checks before clicking catch the overwhelming majority.
A password manager stores one strong master password-protected vault of unique passwords — pick a reputable one, install it everywhere, and change your critical logins first.