Treat this as a potential security incident: preserve logs, disable unauthorized accounts and investigate server/database access.