An operating system is not "stable and secure". A properly configured and well-administered infrastructure can be made more secure than one that isn't, but security isn't a boolean. You can't "buy security" or "install security" by using a particular product / technology.
You're not a "Linux expert", so it makes sense that you need to hire / contract with someone who can configure your servers well, from a security perspective. It's not something you can do one and "be done". Patches are being released all the time for newly found vulnerabilities and bugs. If you don't have an employee who has the job of keeping up you really need to consider subscribing to some type of "managed" service to maintain your server computers. This is an ongoing concern, and needs to be factored into the budget / TCO of the system as a whole.
There are "hacking monitors", to some extent. Intrusion detection systems (IDS), intrusion prevention systems (IPS), etc, fill that niche. It's an arms race, though. You can't just purchase an off-the-shelf IDS/IPS product, pay somebody to put it in, then sit back and feel smugly secure. Just like keeping operating system software and application software patched, the "hacking monitor" infrastructure must be kept up to date, too.
You need to talk to a lawyer. You may have clients located in places where you are bound to disclose such occurrances by law. Even if you're not, it sure seems slimy to me not to let your clients know if their data was placed at risk. There's the damage to "your good name" now in disclosing the hack, but there's a multiplicity of that damage if it comes out later that you tried to cover it up-- especially if you're breaking the law by doing it.
Your hacked machine(s) are trash. They need to be reloaded from a known-good backup or, better yet, reloaded from clean OS binaries and re-populated with data. This is like "malware cleanup" except worse, because your adversary is much more likely a thinking being instead of a dumb piece of software (though you may have been hacked by a 'bot). The chance that there are "back doors" in your servers is real.
The data on the server computers should be considered to have been disclosed to the public. Even if it's not now, it could be.
Any credentials to other computers stored on the hacked computers are public. Start getting those passwords to other computers changed NOW and make sure that the other computers are intact. (Does anybody user Tripwire anymore? That'd sure be nice in this occasion...)
You've got a mess. Handle it well and you will come out better. Handle it poorly and, next time, you may not have a company.
In the future, you should be using strong authentication and encrypted management protocols (SSH, public-key based authentication). I've already suggested that you get a "Linux expert", even if it's just on contract, to get you started down the right track. I can't encourage that enough. You'll get to see, with this breach, how that would have "paid for itself".
All the common stuff applies:
- Don't run services you don't need to.
- Disable default credentials.
- Follow the principle of least privilege.
- Have tested, offline, and off-site backups.
- Know your legal requirements re: breach disclosure.
- Keep your systems / applications updated.