A: If at all possible stop using the systems which you believe has been compromised.  It could be used as a launch pad for additional attacks within your network...

If you believe there has been financial loss to your organization you should report the intrustion to your local authorities.  They will help determine which agencies should be involved in the investigation.  Whether or not you choose to report the attack to law enforcement you should contact a reputable digital forensics investigator to determine how the attack occured, the extent of damage and provide a plan for avoiding similar attacks in the future.