I work in IT security, PM if needed. First thing, enable 2FA ASAP, for ALL accounts within GSuite if possible. Secondly, require all users to change passwords, and ensure that those aren't passwords used anywhere else.
You might also need to pull logs and look at what happened, maybe a lot, maybe very little. Won't know without looking.
For those reading, enable 2FA on every account you can and do not re-use passwords. Authy is free, and an excellent tool for this:
https://authy.com/guides/googleandgmail/
-Ari