Thank you very much for the advice!
But what I’ve taken away from this situation is—no more admins. My next assistant will do everything offline, and I’ll handle the website updates myself.
It only took the hacker a couple of minutes to cause trouble and move on. Honestly, I was lucky that he acted so blatantly instead of trying to embed some malware into the working version of the game.
I’ve changed the password too. So, lesson learned. No serious harm was done. Those players who downloaded the malware did it for free, which means, as compensation, they now have access to the games and all future updates.