My almost ci site hack

First place I would check is the FTP logs. If the files where altered though FTP change FTP passwords, restore sites from your backups and also change database password afterwards.