If you don't have internal IT folks and an incident response team already in place you're going to need to bring in some outside assistance. - Take all comprom

If you don't have internal IT folks and an incident response team already in place you're going to need to bring in some outside assistance. - Take all compromised or infected systems offline immediately and have them carefully examined to determine what data those systems contained (customer, internal, and employee) and what was exposed to attackers. - look for additional signs of compromise in other systems as well paying close attention to those connected with the ones that were compromised - log and record everything extensively throughout the process - consult with your lawyers to see what legal obligations you have to disclose the breach publicly - notify everyone directly impacted by the breach as soon as you've identified them so they can start taking steps to protect themselves. Don't wait until you have all the details, you can update them as more information is discovered. - Make sure you have professionals to perform the investigation and re-secure your impacted systems before they are put back online. This isn't the time to count on that one guy in the office who "knows computers real good" to fix it. - continue to keep extensive logs and keep a close eye on everything for a time after the attack to make sure you're not compromised again. If you can manage even that much you're doing better than most of the companies I've seen who were hacked. I've seen banks leave compromised systems connected to the network for months after being notified. I've seen some pretty large companies refuse to bring in outside help because they don't want the expense even after they get hacked over and over. Many small to midsize companies try to handle everything as quietly as possible and never tell anyone what happened.