Hello,
if you have a backup, maybe you can restore this in a VM not connected to the internet ? That way you can decide who has access to the server and are able to use the complete functionality.
Depending on what/how it is compromised trying to do a postmortem would also be good ?
Greets,
Mayk