Step 1 : Gather your team
If you have an incident response plan, enact it now, you probably don't which is why you are here.
You can't respond to this alone, gather your team, you will need representatives from not just IT but your board, Legal, HR, PR and Facilities - if you don't think everyone is involved, think again.