Almost recovered everything now, it was a hacker that had logged into our system via rdp.