I have had to clean up similar in previous job helping tracking down a larger intrusion. Call the police and ask for advice

Here is some server advice, given that the server does not have ransomware.

  1) Save the memory of the machine if possible /dev/mem to disk it may have proof how the hacker got in.
  2) Save process list of the machine
  3) Save the netstat -plunt TCP/UDP output to file, you want to see which TCP/UDP connection the machine have before its turned off. 
  4) Check for any strange process in ps list
  5) If you see any strange process visit /proc/PID and check CWD current working directory and start commands.
  6) List kernel modules with lsmod and dump to file
  7) Power off the machine with the power button, reason you do not want to run any of the normal powerdown scripts
  8) Take a system image of the disk to an external hard disk for proof. This is important that you do not tamper with file access/last modification,change time.
  9) Pull out the network cable
  10) Power on the server again, backup all data files to external media
  11) Read log files
  12) Wipe the hard disk and reinstall the operating system with latest version
  13) Change root and account passwords
  14) Use an SSH key
  15) Lock down ssh port 22 to known IP numbers
  16) Apply all security patches, operating system and applications, make sure applications are running latest patched release
  17) Restore data backup
  18) Deploy host intrusion detection system, HIDS
  19) Send logs to an external machine

Optional steps

  20) If authoritative suggest it try contact the person and ask how he/she got in.
  21) Make a copy of the system image from step 8
  22) Examine system image and logs with something like Autospy from Sleuthkit, you can check last access times, read web and ssh logs.
  23) Ask upstream ISP providers if they have ssh connection logs. Ask if you can get them.

Additional resources Mozilla how to secure SSH https://wiki.mozilla.org/Security/Guidelines/OpenSSH Debian 5.1 how to secure ssh https://www.debian.org/doc/manuals/securing-debian-howto/ch-... Sans top twenty security controls https://www.sans.org/media/critical-security-controls/critic...