The silver lining in all of this is that they got an older/broken version, so they wont have anything up to date. As you update your game more their stolen assets will become more and more out of date, rendering them useless. For the future, I would recommend avoiding putting things in areas that the client has access to - e.g. player, replicated storage, ect.
Some overkill steps you could take:
If you wanted to take some extra precaution, you could update your scripts to include a check for what place they are in - if they don’t match the place id of your game, make them destroy themselves or not work. You might need to hide this somehow, like making it a part of some of your modules, and it runs under cover of multiple functions (e.g. you call Module.Method() and in this method, it performs the check - if the check fails, the script is destroyed - include this check in multiple methods in each module). The effectiveness of this all depends on how dedicated the attackers are to reading through your scripts and getting rid of these checks.
I wouldn’t recommend this method since they could search for the place ID in your scripts to remove the checks unless you took more steps to hide that as well, and all of this might not be worth the effort to implement if you can just update your game to make their stolen assets outdated.
