In that sense, defending against any cyber attack ultimately comes down to an element of luck,... that the attacker didn’t gain access one level deeper, that th

In that sense, defending against any cyber attack ultimately comes down to an element of luck,... that the attacker didn’t gain access one level deeper, that they didn’t exploit a particular vulnerability that would have allowed wider or more persistent access, etc. As far as initial response playbooks go, I would imagine password reset (with session clearing) and restore from known working backup is a pretty good start.