It could have been many things such as an insecure host (that’s often the case) or running an old and insecure plugin or theme (which is why updating is important).
Sadly you’ve a lot of work to do. Delousing your installation is not easy or fun. ;(
There is a big unknown as to what it may be, but you can ask your hosting providers to help you search where the hack may have taken place by looking through your website’s server log files. It will hopefully be in your hosting provider’s interests to find the cause of the hack.