Someone came on my server and said they took all my files and server password! Is that even possible?
They could take the client side files that are streamed to them (mostly useless without the server-side files).
You could have also had an insecure server (Example: FTP, SSH, etc). Most likely sounds like the guy is trolling.
So most likely he didn’t get my cars and resources.
They can get your client scripts/resources, but not the server files. That’s it. Unless your password is password or 123 or something similar for your ftp/ssh, then of course anyone can get all your files.
Also, this is not a FiveM related discussion, it’s rather about the protection of your server hosting machine.