A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access it on my LAN. Today I logged into the server and noticed several databases were deleted from phpmyadmin and the logs show many IPs connected to phpmyadmin.
The server itself contained no critical or personal info. Whoever penetrated my server created a database with a table telling me to send .05 BTC to an account if I want my data back, but the databases they deleted/exported are honestly not that important to me.
What I'm worried about is if they were able to access the rest of my LAN. What should I do to check? I disabled the DMZ setting and checked, port 80 is no longer open from outside my network.