My Employer Changed My Direct Deposit Information Without My Permission

Late yesterday morning, I received a push notification from the system my employer use for payroll, time cards etc advising that my direct deposit information had been changed. The bank shown on the email does not belong to me and is not well known. I also had not initiated or requested the change. I immediately went to the HR office to see what was going on. HR confirmed that the changed had been made because I had requested it. I advised them that I had not. I was advised that an email had been sent, a gmail not my company email, to upper management early that morning claiming and posing as me providing new banking information to which they wanted my paycheck to be sent to. Upper management emailed them back providing details about the operations of our company, and directed them to our HR person. Another email was sent to HR from the same email claiming to be me requesting the change. HR, without checking my employer records to confirm my identity or if the email even belong to me, change my direct deposit information solely based on the information the individual provided via this email.

After advising the company that it wasn’t me, my payroll was corrected. I however have had to freeze all my finances because I don’t know what is happening and how much information about me they have. I have filed a police report with the local department, but was advised that without an actual location of the bank, they are unsure if they have jurisdiction to investigate.

I’m paranoid because I was the only one targeted in the company so I feel it’s coming from someone I know. I struggle with PTSD and I’ve been on edge

Any advice would be helpful at this point