Has there been a general notice to anyone who's had your services provided to them that they may have had their data breached, so that they can change their password or do whatever they need to do?
What kind of data do you keep? Is it their address, financial information or credit card information? What types of data could have potentially been stolen?