Magento hacked store: first response checklist

If you suspect a compromise, do not immediately delete files or restore a backup without thinking. Take a snapshot of code, database and logs so you can understand what happened and avoid restoring the same problem.

Disable suspicious admin users, restrict admin access, block obvious malicious traffic, take affected payment components offline if needed and check whether checkout has been modified.

Once the store is stable, find the entry point. Missing patches, exposed config, weak credentials, abandoned modules and writeable web roots are common causes.