Restore Hacked WooCommerce Store

My online store runs on WordPress with WooCommerce and it has recently been compromised through unauthorized access. I have already lost access to parts of the admin area and notice unfamiliar user accounts appearing. I need the site fully restored to a clean, operational state and then hardened so this does not happen again.

Deliverables I expect:
• Immediate lockdown and clean-up of all malicious code or backdoors
• Restoration of legitimate files, products, orders and customer data without loss
• Secure re-enablement of admin access (new credentials, correct permissions)
• Post-recovery hardening: core, theme and plugin updates, firewall rules, security plug-ins configured, database check, off-site backup set up
• A brief report outlining what was found, the steps you took, and recommended next steps

Please be comfortable working directly in WordPress, WooCommerce, cPanel/SSH and with security tools such as Wordfence or Sucuri. Speed is critical—I need the shop selling again as soon as possible while ensuring the fix is permanent rather than a quick patch.