This wasn't kids. It was an extremely sophisticated hacker network operating throughout the net. Once they do their thing, finding what they did is like finding a needle in a haystack. You try this, and that, hoping to get it all.
Today, our web host messed up big time, and that was why we were down so long. I asked for a restore from yesterday. Waited 7 hours. Then they tell me they can't restore from 9/16 due to the hacks and the best they can do is 9/13. (After 7 hours of waiting).
I took the 9/13. Had them upload a backed up 9/16 database to our SQL server and we were good to 9/16 on data. Some attachments are lost from 9-13-13 to today, because attachments were in files the hackers deleted and the web host cannot get closer than 9-13. Database info including personal data is fine.
From now on, attachments will be separately backed up each day. If I can get a later backup, I will.