Getting hacked is one of the downsides of being a webmaster. It can happen. However, you should also take your part as the web owner to help prevent it from happening in the first place. Since you are hacked, all the provided steps
@Sam has provided are very accurate. However, here are a few more.
If you have the backup and you restore it, not only change your database passwords, but also the database usernames. This will ensure if the hacker got access to the database and was able to figure them out, changing them will make sure they don't know them if they try to hack you again.
As Sam mention changing the location of the ACP can be very helpful. BUT, to ensure even more security and safety, password protect that directory with a very secure password that you do not use on anything.
If you want to take an even further step, do some re write rules to only allow your IP (or others you trust in to the acp) to be able to get into the ACP.
Check your logs. See if your able to find away on how they got into your backend or database to begin with. If you find out, make sure you fix the error. On top of this, make sure all of your software is up to date at all times.
FYI, as suggested by a user, I have removed the link to stop people from mistakenly clicking on the link that may or may not give them a surprise or two. Can never be to safe with hacked websites
