The attackers has done everything they can to cover their tracks and to plan for long term stay. The best effort now should be building a firewall between the data and attackers so no further damage can be done. That is the product we spend last 5 years to build and ready to go.