"As soon as we learned of the attack, we patched the vulnerability and closed the access that the hacker had." Ok, so striking out so far. The machine is still

"As soon as we learned of the attack, we patched the vulnerability and closed the access that the hacker had." Ok, so striking out so far. The machine is still running? With the same software (patched) and user accounts? How do you know only 3 users were exposed?