Yes, turns out things weren't nearly as bad as they looked. We're fairly confident, while the attack affected a lot of users (um...all), it was relatively trivial compared to what it could have been. All information like ftp servers, etc., is in a different database than the one compromised. And we had a backup of all the data that was changed within a couple hours.

Thanks.