First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally I would download it so you have a reference. You may not want to download everyone else's data but you should take screenshots. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal problem not an IT problem.
Contact your internal lawyers, plus your communications or media people. You need to get this breach onto their radar. The lawyers will then need to look into the commercial contract with the contractor probably via the account management team if you work for a big old company. No one in senior leadership will want to find out about it from everyone's favourite IDS: Twitter. Your comms / PR teams will need to deal with any messages that come about from this. Your executive team may need to be involved. You should get guidance from your CIO unless you are the CIO in which case I would be inclined to inform people internally.
Engage with your company data protection officer. That may be the lawyer. They will decide if the breach is GDPR / ICO notifiable. You have to do this quickly as you have 72 hours to make the decision from the point you are aware, that includes the weekend. (never go looking for incidents on a Friday...) Your DPO will advise. If you are the DPO then you might want to engage your company external legal counsel to confirm your decisions.
Once you have looked at the data, you will be able to advice how many data subjects are affected if any. You will also be able to determine if the data breach affect any of your clients as you may have a contractual obligation to inform them.
Contact the hosting company. If it's something like github then they may be inclined to play nicely. You may need to get your lawyers to write to them as officers of the company.
Contact the contractor, ideally via their contracted company and via the in-house lawyer. Demand they take down what is there.
Now you can start to work out the material impact to your business. Credentials, keys and other authentication tokens will need to be changed I expect.
Depending on the size of your company and your appetite to risk and your pocket size you might want to consider bringing in a forensics-type company to go out hunting for similar data. Yes I know it's a bit of security theatre but if you work for a FTSE100 firm then a report with a Big4 audit badge saying "no more issues" is exactly what you need should the midden hit the windmill. (I am amazed at what I see big firms spend on such reports as, of course, the same thing from an internal person is often considered to count for little).
I am not sure about the data that is not yours. If you start trying to engage with third parties then you are bound to be asked what data you have got from them and they are bound to ask you to confirm that any data you have taken has been deleted. Personally I'd be inclined to ignore any data that is not mine. You might want to make a disclosure to whomever you think is the data owner, entirely up to you.
You mention keylog, if you are wondering why an individual might have a keystroke logger on their own PC then well to be generous they might be using it as a simple backup of what they type. I know people who have done that.
Aside: Finally as a tangential observation, what you have found is not that uncommon. People store all kinds of junk for example people link their home data storage to the internet via FTP: we run regular assessments for such data that contains our company strings.