Answer
Restrict or revoke the public access, preserve relevant logs, identify what data was exposed and for how long, and start the organisation's incident assessment and notification process.
Explanation
Fast containment can reduce further exposure. Evidence about access and scope is also important for deciding what notifications or follow up measures are required.