In a case like this, the most important first step to take is preserve all written records. In particular, you need to have the proof that you were the one who collected the data—perhaps it’s in the form of laboratory notebooks in your own handwriting, emails showing that you were the one who collected the data, or anything else that unambiguously shows that you were the data collector. This protects you from any charge of wrongdoing.
The second step is deciding if you want to take action in this matter. If you feel the use of the data is sufficiently problematic and you are willing to deal with the fallout of reporting your advisor and a fellow grad student for plagiarism, then you should cautiously proceed. However, if no one has raised any issues and you don’t want to make an issue out of it, it is understandable that you might want to wait until you are no longer directly part of the group before taking any action (or doing so anonymously).