I think my Instagram got hacked. What are the very first things I should do?

Deep breath, here's the order that works. 1) On the login page hit 'Forgot password' and try both your email and phone. 2) If that fails, use 'Need more help?' then 'My account was hacked', it can send a login link or ask for a video selfie to prove it's you. 3) Secure your EMAIL account first (new password, 2FA), that's usually how they got in. 4) Once back in, revoke sessions under Security > Login activity, change your password, turn on two-factor. Don't pay anyone promising to 'recover' it.

Okay, deep breath. Here is the exact order that works, and the order matters. First, secure the email on the account, not Instagram. Nine times out of ten they got in through your email, so change that password right now and turn on 2FA for the email itself. If the email is still compromised, resetting Instagram is pointless because they will just reset it back. Second, use Instagram's own recovery: on the login screen tap "Forgot password", and if that fails go to "Need more help?" then "My account was hacked". It can send a one time login link, and if that does not work it will offer the video selfie verification. That selfie route is slow (mine took about two days) but it is the one that actually gets accounts back, so do not give up on it. Third, once you are back in: Settings > Security > check "Where you're logged in" and log out every session you do not recognise, change your password, and turn on two factor via an authenticator app. Fourth, check that the email and phone number on the account are still yours, attackers quietly swap them. If the email was changed, Instagram usually emails you a "was this you? revert it" link, use that. Do not pay anyone on the internet promising to recover it. That is a second scam layered on the first.