Online file hacked and employee bank account details changed

Hi I've just discovered that my company file has been hacked and someone has changed the bank account information for two of my employees and also their email address for pay slips (it just happens to be the same account). 
We have MFA activated and my PC has been checked for malware and is all clear. Nothing suspicious in terms of people accessing the file either from the security session report.

Has anyone had the same happen and if so any tips on what to do? We have completed a pay run without knowing about the fraud so I'm not even sure if the bank will refund the monies!!

Thanks for any advice.