I would advise them to consult an indpendent company for a complete security audit of their IT systems.
How condescending .
Not at all - as you've already had your systems compromised, seeking outside help from professionals is not a bad thing to do.