Database hacked, need to recover

Hi, Sorry about the chaos, yes, I can walk you through it right away: 1) Contain: Block public access to the DB (firewall/NSG → deny all except management IP), unplug any public IP/NAT, set the DB to read-only if possible; immediately rotate all credentials/secrets (DB account, connection string, server account, Storage/SAS keys, API keys) and invalidate sessions/tokens. 2) Preserve evidence: Take snapshots/backups of DB and disks (server/VM), export logs (Enter Sign-in/Audit, Activity Log, DB audit/threat detection, WAF/Firewall) and note the incident timeframe. 3) Clean restore: If it's Azure SQL/MI, use Point-in-Time Restore on a new isolated server; if it's PostgreSQL/MySQL (PaaS), use PITR on a new server; if it's SQL/MySQL/Postgres on a VM, restore from backup on a new hardened VM; Do not reopen the compromised instance. 4) Verify & cutover: Run integrity checks (e.g., DBCC CHECKDB, ANALYZE, CHECK TABLE), compare row counts/hashes with the latest good backup, restore users/permissions to the bare minimum, then point the app to the new endpoint. 5) Remediate persistences: Remove suspicious users/roles, malicious jobs/agents/triggers/CLR functions or extensions, check server-level policies/credentials. 6) Harden: Enable Private Endpoint and disable “Allow public network access,” use Login ID for DB authentication, MFA/PIM for admin, Auditing + Defender for SQL/DB with alerts, Log Analytics retention ≥90 days and backup retention ≥35 days (often 7–35 days PITR + long archive), patch OS/engine and app, principle of least privilege. 7) Compliance: If there's a risk of data leaks, align with legal representatives/DPOs (GDPR, etc.) for possible notification; don't pay ransomware. 8) To help you immediately, send me (even just a rough outline): DB type (Azure SQL/MI/Postgres/MySQL or DB on VM), region/resource and ID, estimated breach window, last available good backup, how it's published today (public/PE/VPN), and what errors/symptoms you were seeing; I'll prepare the exact sequence (PITR/restore) and the firewall/PE rules to apply.