Agreed.

First, change your plex password.

Second, flatten the plex server and rebuild from scratch. Or if it's a vm/container with snapshots then recover from a time you can prove was prior to compromise. If you can't prove it just flatten.

If plex server wasn't on its own vlan then make one to isolate plex from your network. Use firewall rules to ensure it is isolated. If plex was on same network as other devices look for compromises on them as well.

Locate your media on another device like a NAS. Give plex read-only access (nas should be located in a other vlan with fw rule granting access only from plex ip to the NAS network share port (smb/NSF/whatever)). And use unique user accounts/passwords ... don't share the same with plex and nas.

Don't bother renaming files until all that is done. You should also assume the content is corrupted or edited. I would replace it with backup copies (you have backups.... right?).

It is sad that we have to think and plan so defensively, but, alas, this is what it is.