I'm wondering what one can do if they have the IP addresses that were used by the attackers during a security breach?
Nothing at all. One word: jurisdiction. If you live, have your server, the attacker IP or the attacker lives on another jurisdiction, there's little chance of authorities doing anything at all. For example, don't expect the Italian provider to provide the American police information about an attack to a French server committed by a Russian national.
You got the picture.
The only thing you can do is to report the attack to the provider. If the attacker is responsible, his account can be suspended (hacking is usually against every ToS of every provider around). If the attacker is not the owner, the server can be taken offline and his owner can correct the issues.
Can I find information about the attacker and possibly use that to report them to the authorities?
The server logs usually can be used, but not as proof of anything. It's not hard to identify an IP address involved on any attack, but it's a different story to identify the actors behind the attack.
The attacker could have used another victim as a platform for launching attacks, and your own server could have been used to attack others, you cannot know. Attacker could have planted false entries on the log to mislead investigation, even if this is rarely used because going after the attacker usually lead nowhere.
Am I looking in the right place for information about the attacker or is there somewhere else I should be looking?
You are looking at the right place, but the wrong data. The IP is the only thing you have.
When you hear about high profile breaches they are often able to track the attack back to where it originated from. I'm curious how that is done.
Almost all the time, the attacker brags about the attack. If the attack was a high profile one, authorities get to hear, and start moving police around the world. Or they steal important data and try to sell online, only to be contacted by undercover law enforcement.
That Hollywoodian scenes showing traces running, IP addresses flowing on the screen and police cars surrounding a house while the hacker is still connected does not exist.
