Hello @tinhpham0997

(Full disclosure I am the founder and CEO of SnapShooter Backup Service

This is a very tricky situations and please take my advice at face value. I am unsure if DigitalOcean have any policies on ransom.

I presume you have turned off the droplet! Never to be booted up again.

I would recommend the following

1) Turn off Droplet
2) Create a SnapShot and label it well (HACKED)
3) Change to recovery mode
4) Book into recovery mode
5) Mount the filesystem and make sure you don’t execute anything on the hacked file system
6) on the mounted file system inspect the following /var/lib/mysql/
7) If these files are intact (which depend on how good the hacker is may not be possible)
8) Report finding if unsure
9) If they are good proceed to extract those files out of the system learn more here https://stackoverflow.com/questions/484750/restoring-mysql-database-from-physical-files

Good Luck

Simon