What to do if a server is hacked? Will Red Hat assist with development of security rules and policies and root cause?

Issue

• There is reason to believe that my server was hacked

• The host started presenting abnormal behaviors

• Sudden jump in network bandwidth and/or traffic consumption

• Unknown allocated space on disks

• New users/groups created on the system with random names

• An unknown root SSH login happened

  Jan 01 10:50:09 server sshd[444]: Accepted password for root from 61.32.27.191 port 4729 ssh2
  Jan 01 10:50:09 server sshd[444]: pam_unix(sshd:session): session opened for user root by (uid=0)
  

• Crond will not start

  starting crond : /bin/bash: crond:command not found
  

• An untrusted IP address was able to login into my system