If attackers use anonymity tools such as Tor, it's exceedingly difficult to trace them back to the person performing the attack, especially after the fact. Think of Tor like a big encrypted mesh, where connections are routed through a random path of multiple nodes. At no point does any one node know both the source IP and target IP.
Attacks against such anonymity networks are complex and require a lot of privileged access to ISP logs and other such resources, so unless you've had significant losses the authorities aren't likely to make the effort.
Things get even more difficult when you're dealing with an attacker that uses Tor to control a horde of compromised computers in a botnet. These machines may be in different countries, with different privacy and computer security laws. Getting access to the data and/or logs on these machines can prove to be a bureaucratic nightmare.
In general, when the authorities investigate attacks, they'll look for something other than the digital trail. It's much easier to catch people by their actions on social media sites, or via paper trails when money is transferred around.
My advice, if you've not lost much in the way of revenue, is to forget about pursuing the attacker and instead focus your time/money into working out how they got in, and how to prevent it happening again.
Now would be a good time to undergo a security review. Here's some stuff you should double-check is being done properly:
- The usual security measures: change SSL port, no root login, use client certs, enforce strong passwords, etc.
- Updates (OS, software packages, IDS/IPS, firewall, AV, etc)
- Security monitoring and alerting, with logs being backed up remotely.
- IPS/IDS/firewall in the right places.
- DMZ set up between internet-facing services and your internal network.
- AV software on any user machines.
- Proper user account management.
- Security policy.
- Event response policies.
It'll be far more cost-effective to focus on preventing future attacks than it will be to go chasing ghosts.