Do shut down the machine instances as quickly as you can. I’m often taken aback by the number of admins who keep compromised systems up and running. Chances are that the hackers have not yet culled all your data, so you can stop further damage by taking those systems down quickly.
Do contact your provider right away. It typically has automated procedures to lock things down for you, and even locate the source of the attack.
Do review your security policies and security tools, at your first opportunity. Something fell through the cracks, and most breaches that I see are due to human error.
Do contact those whose information may have been compromised. The days of keeping breaches to yourself are long over. If Social Security numbers or credit card data has been compromised, the owners need to be contacted so they can watch for fraud. If it’s personally identifiable information (PII) or other protected data, you need to contact your regulatory authority as well.
