Hacked, oh dear

I haven’t been on my site for 2 days and see I’ve been hacked and I’m not even out there yet:

Messages:
Your access to this site has been limited
Your access to this service has been temporarily limited. Please try again in a few minutes. (HTTP response code 503)

Reason: Manual block by administrator

Important note for site admins: If you are the administrator of this website note that your access has been limited because you broke one of the Wordfence firewall rules. The reason you access was limited is: “Manual block by administrator”.

If this is a false positive, meaning that your access to your own site has been limited incorrectly, then you will need to regain access to your site, go to the Wordfence “options” page, go to the section for Firewall Rules and disable the rule that caused you to be blocked. For example, if you were blocked because it was detected that you are a fake Google crawler, then disable the rule that blocks fake google crawlers. Or if you were blocked because you were accessing your site too quickly, then increase the number of accesses allowed per minute.

If you’re still having trouble, then simply disable the Wordfence firewall and you will still benefit from the other security features that Wordfence provides.

If you are a site administrator and have been accidentally locked out, please enter your email in the box below and click “Send”. If the email address you enter belongs to a known site administrator or someone set to receive Wordfence alerts, we will send you an email to help you regain access. Please read this FAQ entry if this does not work.
~~~~~~~~~~~~~
— My site has been Damaged.
— Noticed few days ago WF msg I received someone was trying to use Frontend (which I don’t use) to get in.
They got in.

— my em says it came from Emeryville. IP has 65k in Network\
I blocked that IP.
Their info: OrgTechPhone: +1-877-453-8353
OrgName: Level 3 Communications, Inc.
OrgId: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
NetRange: 4.15.0.0 – 4.15.255.255 [65536 addresses in this network. Click to block this network]
CIDR: 4.15.0.0-4.15.255.255 [65535 addresses in this network. Click to block this network]

Should I block Entire Network?
12.26

— You do not currently have a WordPress Security Firewall user session.
Please login again.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

https://wordpress.org/plugins/wordfence/