I have read over similar issues posted on the forum and can't find the answer to my situation.

Background Information:
Our website (https://proofreadmyessay.co.uk) has been steadily growing in terms of impressions and clicks for the last few years. We see an annual drop in search volume and traffic over the Xmas break, but a part from that it's relatively predictable. We have 2 other (near identical) localized sites that we run (https://getproofed.com) and (https://proofreadmydocument.com.au). We implemented HREFLANG on the latter two sites around January 2019, however have held off for the former as it is currently our busiest site, and we wanted to wait until a quieter time of the year.

Since January on all sites we have seen consistent growth.

Issue Overview:
Around May 10-13th 2019 we saw a drop of around 80% of our clicks, a larger percentage of impressions and a huge decrease in our search position.
We have an expected and annual drop around Xmas, however we have never seen a drop this time of the year.

Potential Reasons:

1. Technical Changes:
Around this time (May 13th 2019) our technical team released SSO between the sites. Since then we have realized that they implemented this in a way that traffic was redirecting to sso.getproofed.com to check if they were logged in on any other site, before redirecting them back. This wasn't how we wanted to implement SSO across sites, but the requirements were not properly understood.

We reversed this change on 28th May 2019.

2. Hacking
A subdomain (ambassadors.) of https://proofreadmyessay.co.uk got hacked around the 13th March. We had removed the subdomain in October of last year, however there was a reference to an IP that we no longer owned in the DNS settings and we think they hacked us that way. The filtered search console from March 13th 2019 to May 5th 2019 for that subdomain shows 628k impressions and 32k clicks.

Google Notified us of this on 4th May 2019 along with a manual action to "warn users of hacked content".

We thought we had dealt with the issue, as we removed the DNS pointing from the server for the subdomain site and submitted a reconsideration with Google to validate on Search Console. This was done on the 6th of May 2019.

We received a reconsideration request note from Google on 8th May. Saying that they have "adjusted or revoked" the manual action. Please note: there are no manual actions now in Search Console.

However, in Search Console on May 31st 2019 we realized that we had over 110k pages of hacked content still being indexed by Google.

So we:

- Submitted the ambassador. subdomain to be removed from the index using the URL removal tool in the old Search Console
- Submitted variations for HTTPS/HTTP/WWW
- Stopped the indexing of the subdomain pages using a noindex added to our sitemap
- Removed previous subdomain sitemaps from Search Console


As of the 3rd June, our Search console still shows the subdomain pages as being indexed.

3. HREFLANG
Lastly (or so we hope) the only other issue we can think of is that the drop in impressions and clicks is related to Google ranking our pages lower because we haven't implemented HREFLANG on the UK site yet. As I mentioned earlier, we didn't want to do this until
A quieter period business wise
We had made some technical changes to enhance the user experience (in case users were served up different geo versions of our site) so they could access the site we wanted.
We had consolidated our brand across the three sites

Summary
So far (although I appreciate that it may be a little early to tell) we haven't seen a recovery in traffic/impressions (on Analytics or Search Console). Even though we have tried to address points 1 and 2 above. Our current plan is to implement HREFLANG on the UK site this week (as the other 2 changes above haven't helped recover our traffic).

I am are not sure if I am missing something, how we can recover from this hack, or if we have done everything above correctly. Advice would be hugely appreciated. Additionally, you can see the visuals of the above graphs on this Google Support forum post: https://support.google.com/webmasters/thread/7329668?hl=en

Please do let me know if anyone has any ideas to help analyse/solve the problem.

Thanks!