Hardcoded API key leak

A security researcher reports that your shipped Android app binary contains a hardcoded backend API key with broad server-side privileges (it can read any user's records, not just the signed-in user's). They decompiled the APK to find it. Your API gateway logs show a spike of requests using that key from non-mobile user-agents and scripted patterns, enumerating user IDs sequentially. The key has been in every app release for ~8 months. You can't instantly force all users to update the app. How do you triage, contain, and remediate this embedded-secret leak?