What should I do to mitigate the damage?
Usually, it is the user's browser that is compromised by XSS vulnerabilities on web sites. You probably won't see any damage done to your site, especially since it was reflected XSS. The attacker would need to target each user separately and convince them to click a malicious link in an email or visit a malicious domain that could launch the attack.
That said, reflected XSS is sneaky and can be combined with other attacks (like CSRF) and that CAN damage a web site. Let's say I achieve a reflected XSS attack where it rewrites all the links on the page to links that can change things on your site. For example, rewrite links to www.example.com/records?record_id=3&action=delete. Now you have a script that can delete records under the authority of whatever user has had their browser compromised by XSS.
I don't believe too many web site owners do a lot of investigation when they find and fix an XSS problem unless there is evidence of an actual exploit.
How to Find out What was Compromised:
If your application writes detailed logs, you might have records of http requests with malicious scripts in the parameters.
If any users have complained that that their stuff has been altered or deleted without their consent, that might also be a clue that someone has taken advantage of the XSS.
For more information, please describe what your web application does and what technologies it uses. You could even post a link to it if you don't mind the attention. That would give the people here more to go on.