If your web service is protected by #cloudflare, your best course of action right this moment is to cancel the contract and inform your users that their passwords have been compromised.

You either reach out to your customers base now or scammers will do that for you.