The attacker (based on the language of the blog (Indonesian)) is presumably overseas. Can i track them down and prosecute?
I would say not; unless you're a multi-national (who can more easily spend resources on chasing people in foreign countries) - this almost certainly won't be worth your time. But this isn't legal advice, so you need to make your own assessment here. The chances of getting any recompense is vanishingly small.
In terms of how they got in, you're going to struggle unless you've already invested in IDSs (Intrusion Detection Systems) of some nature. The golden rule here is that once compromised - you can no longer trust the machine. The attacker may have deleted logs, changed timestamps, etc. Similarly with where it came from - your ISP may be able to help (if you're sure they're Indonesian - ask for all traffic to/from Indonesia, assuming that's not a country you often do business with).
You can look through the logs on the server, specifically the HTTP access logs - the most likely attack vector for a web-facing HTTP server is going to be through insecure web software. Check your software versions for known security issues (Wordpress is pretty notorious for this), check that your passwords aren't simplistic.
The most likely scenario is that some automated worm, probably using Google, found that your site was running a bit of software with a juicy vulnerability and hit it. I'm speculating, but without any more details, that's likely where we are. If you're on a public web host, and any of your files or folders are world-writeable, it could be any of the other sites hosted on your server.
Assuming you find anything; contact your local law enforcement if you think it points somewhere, but I wouldn't hold my breath. If you're in Government or largeish Enterprise, you should have a team, agency or the like to report to - make sure you do do that.
The big thing here is that, since you can no longer trust the machine (bolded again, it's important), your best option is to start over. It's harsh, but if they have local admin, you're just going to get hammered again.
It sort of stops being a security question once you've actually been compromised - have a look at http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server for other advice, but it starts becoming a legal risk question for your organisation (Is it costing thousands being down? Is it worth booting a maybe-bad server?).
Build everything up again, patch everything, restore your last DB backup. When you put together the server, make sure you lay a secure baseline (Server Certification Processes) so that you can look at the logs saved on a different machine, one you can still trust.