Hire an incident response firm. They can usually react next day if you can sign a contract today.
Any idea how much can such a service cost, assuming web application with a very common stack (such as Ruby on Rails + PostgreSQL)? Is it something like $5k, $10k, or $20k+? Or it really depends? Sorry if it's a very amateur question, I have no experience in dealing with such companies so have no clue how much can it cost.
Security is not cheap.
Disclaimer: worked for such company.
You need to bring an expert and/or firm on-site.
If you need security professional I can help you. Is the box on AWS, if so that would be a perfect use case for us? You won't have to worry to much about costs since we're starting up we're willing to work with your budget if you provide a testimonial for our website.
Send me an email: [email protected] and we'll get started quickly.
I hate to be this guy, but you don't want to offer IR/forensic services if you don't have experience doing exactly that.
Your client can sue you if you get it wrong. (http://arstechnica.com/security/2016/01/security-firm-sued-f...)
I took action and updated firewall settings (which were too loose), ensured that offsite backups are in place if worse comes to worst, rotated all api keys etc, meanwhile trying to contact the anonymous person. Will rebuild the servers asap as well, super glad that we have properly maintained ansible scripts.
Also will try my best to convince the CEO to allocate some money for professional audit/consultancy since we are no experts in security and to reduce the chances of future incidents.
Trying to do our best and avoid things like SQL injection, XSS, etc but no one is secure after all.