In general, nothing. But before you restore backups (if you have any that weren't encrypted) you may want to determine the exact time at which you were compromi

In general, nothing. But before you restore backups (if you have any that weren't encrypted) you may want to determine the exact time at which you were compromised, or else you'll be restoring potentially tainted backups. Depending on how well you're organized that alone will take weeks, especially considering that your logs may be encrypted as well. Sometimes you don't even know how to contact everyone, because your comms are down, too.