All MYSQL databases missing. Dont know hacker nor attack vector yet. Here is what I found on victim server:
_x000D_
# ls /var/lib/mysql/PLEASE_READ_ME_FXF/_x000D_
total 120_x000D_
-rw-r----- 1 mysql mysql 61 2019-01-14,02-34-16 db.opt_x000D_
-rw-r----- 1 mysql mysql 8676 2019-01-14,02-34-29 WARNING.frm_x000D_
-rw-r----- 1 mysql mysql 98304 2019-01-14,02-34-33 WARNING.ibd_x000D_
_x000D_
# strings /var/lib/mysql/PLEASE_READ_ME_FXF/WARNING.ibd _x000D_
{0XYY_x000D_
0XYYX_x000D_
infimum_x000D_
supremum_x000D_
To recover your lost data : Send 0.04 BTC to our BitCoin Address and Contact us by eMail with your server IP Address or Domain Name and a Proof of Payment. Any eMail without your server IP Address or Domain Name and a Proof of Payment together will be ignored. Your File and DataBase is downloaded and backed up on our secured servers. If we dont receive your payment,we will leak your database. 1MUhSTik1iNuK9wVrhaBLQqVTjeLzCkMQs _x000D_
dbrecover@pm.me_x000D_
infimum_x000D_
supremum