WOW so much false sense of security in the comments. I guess there is bliss in ignorance, if you don't know how the security works you don't know how much it sucks (which always might be - not at all, but that needs to be proven first)

The need to reset database and SFTP passwords indicates that there is a non zero possibility that the attacker got access to the DB, and if that happened then no password reset will help at all as he could have created for himself an admin user to be used much later.

The only way to securely recover from a security breach is to return to a backup from before it happened. Any other way and you are just assuming that you have found all the backdoors which were installed in the breach.