A Joomla site can get hacked due to the vulnerabilities of plugins, weak passwords or outdated extensions. One of the most common security mistakes is continuing to use the default username 'admin' which is created when Joomla is first installed.

Always to have good backups.