The sysadmins need to change the DNS to point to a status page, perform forensic dumps of the servers, and perform incident response 101 ASAP. There's no excuse leaving an attacker controlled message up for hours.