Viscosity

Sometime you do not need to go through the painful process, if you learn to take hints and digest what given by people. Do some study and learn from people. Nothing is bulletproof including NASA website has been hacked countless times.

A lot of times people getting hack also contribute to their personal security mindset is not there such as using weak username & password for ftp instead of sftp account, not using security plugins(wordfence, bulletproof ,etc)or services(cloudflare, incapsula, any other services which uses cloud & CDN), etc. Usually a good password with upper,lower ,special characters and numbers of a minimum 15 characters length which make very harder to crack using dictionary attack. Even if attackers can download the password hashes and attack with rainbow tables in which also require so times to really crack your password. Before i proceed further, i have to stop here before getting the post deleted 🙂

Note : Being conservative toward computer security is just a good target for crackers/ script kiddies. Rejecting it is just being naive.

It seem like it has been already reset back to default.

Who me?

Then it can be quite certain that the hack is done through exploit in the theme. Probably you can provide what is the theme name you are using that other site which may uses the same theme as you host on the same web hoster.

Potential the site has outdated plugins or exploited found in the plugins / wordpress that cause the malware infestion which lead to the massive hack. You can see the antivirus scan report.