What steps do I take if my company's VPN was hacked in a cyber attack?

First of all, turn off the VPN and check with the service provider to ensure you understand how they plan to respond. Your VPN should have an emergency response team in place and a process for reporting attacks. Check with your internal IT department to find out if any action needs to be taken on their end.

You may also want to consider contacting law enforcement or other authorities about your information security concerns. Obtain as much information about the attack as possible. If there's anything unusual about the attack that you can connect back to a person or organization, that would be helpful information for the authorities investigating this attack. Finally, when setting up the new VPN service, change all your passwords and the location of sensitive data.