Did you have two factor enabled? Does the thief have access to your recovery email?
Regardless there are things to do right away regardless so don't hesitate!
GoRefer to here:
https://support.apple.com/en-us/HT201472
If Find My iPhone isn't enabled on your missing device
Change your Apple ID password. By changing yourthe Apple ID password, you can prevent anyone from accessing your iCloud data or using other services (such as iMessage or iTunes) from your missing device.
Change the passwords for other internet accounts on your device. This can include email accounts, Facebook, or Twitter.Support article:
Report your lost or stolen device to local law enforcement. Law enforcement might request the serial number of your device. Find your device serial number.
Report your lost or stolen device to your wireless carrier. Your carrier can disable the account, preventing phone calls, texts, and data use.
If Find My iPhone isn't enabled on your missing device
If you didn't turn on Find My iPhone before your device was lost or stolen, you can't use it to locate your device. But you can use these steps to help protect your data:
Change your Apple ID password. By changing your Apple ID password, you can prevent anyone from accessing your iCloud data or using other services (such as iMessage or iTunes) from your missing device.
Change the passwords for other internet accounts on your device. This can include email accounts, Facebook, or Twitter.
Report your lost or stolen device to local law enforcement. Law enforcement might request the serial number of your device. Find your device serial number.
Report your lost or stolen device to your wireless carrier. Your carrier can disable the account, preventing phone calls, texts, and data use.
Find My iPhone is the only way that you can track or locate a lost or missing device. If Find My iPhone isn't enabled on your device before it goes missing, there's no other Apple service that can find, track, or flag your device for you.