the server, do you still access? who manages your server? has the domains nameservers been changed? who now has control of the domain? do you keep backups?
regarding the selling of data, you cannot win, so pay him nothing. If you pay him an amount he can just ask for more, and even if he gives you what you want, there's nothing stopping him retaining a copy of the data and blackmailing you again.
Step 1: regain control of your domain and/or server
Step 2: sort server security out
Step 3: restore backups
Step 4: mail your userbase telling them what has happened (up to you, I'd probably only let active users know)
Step 5: if your userdb stores plaintext passwords, reset everyones password and get them to choose a new one
Step 6: if your userdb doesnt store plaintext password(more likely), so nothing
Step 7: tell your pal to fuck off
