Hi, I am working on an assignment where a hospital data was hacked. I have to advice the CEO what steps he should take in a moment of crisis?

So, one of my questions is this: if the hospitals data has been hacked, and the suspect is a third party from IT department. For internal communication do I still need to notify the IT department about what happened or just notify other department's like doctors, nurses, etc.?

The reason I asked this question is because since the suspect is a third party from IT department, does it really make sense to notify IT department as an internal communication because how much can you trust IT department at that point.

What if there is another person in the IT department who probably was involved with the third party contractor and no one knows yet?