Some feedback from my hosting company:
It is difficult to say in which way you website was hacked. Probably, surfing the internet you clicked on a link that allowed a person to access your web browser cookies where all passwords are cached. Please do not click on any suspicious links in the internet or spam messages.
As you probably know your login info can be taken from your browser’s cache by some virus, then credentials to access your hosting account can be delivered and used by somebody else. So, the most vulnerable place can be your own PC and I do advise you to check it with help of some good anti-virus software and then change the login info to access any area of your account.
and
You have to make sure all software, all the modules and plugins used for your site are secure and fully patched, so that they do not have program holes. And it is strongly recommended for you to check your file/folder permissions which should be 644 for files and 755 for folders and executable files (scripts).