First scenario: First priority is to branch and patch the hole asap. There's no point dealing with this if someone else is going to put you back in this position a month later. Make sure everyone in the company is on the same page, and then unfortunately i'd probably attempt to verify that the request was legitimate, and ask for proof with the pretence of being willing to pay.. Try and think of some way to make the information useless to the perpetrator, but in the end, i probably would pay up (under some contract) and maybe offer employment as well.
Could possibly whip up a bug reporting program, with well-defined rewards in the vicinity of what was being asked, and give the perpetrator a nondescript shrug toward it. That way the perpetrator gets an easy, moral way out, which is almost as important.
Second scenario: Security audit, change all passwords, IP restrict logins, re-encrypt all user passwords on login. Hopefully there was no sensitive data - then i would wait it out to see if it turns into scenario one. It would be embarassing to send out apologies + service credits if it wasn't malicious (not just e.g. the hosting provider doing maintenance, someone using a proxy, someone working out at a client's site, a contractor's ip you've overlooked, etc)
It always feels like someone's done the right thing when you read stories about services notifying all their users, forcing password changes, and so on. But you have to keep up your business, and it's not like you can just shut everything down, rewind time and never program again. Damage control and move on.