As this is my first, I'm unsure nature of the breach and what i need to do.
I have check a few sites (i.e haveibeenpwn) for breaches, but found none

As a precaution i have:

• Suspended the DA user account and server for a day. (i control both user and reseller account)
• Change all user password in the domain.
• Change SSL (after i unsuspend later)
• Notify the provider of the breach

So do i need to do anything else?
How do i know if its a simple password breach or much worse?

EDIT:
changed the title to reflect nature of the breach
Found the offending pc. office user brought their laptop to a 3rd party services during the weekend.
so far seems to be a spambot, scanned all the other check the entire office pc seems good.
wasted entire day