Security Checklist/You have been hacked or defaced/13/en
From Joomla! Documentation
Change all passwords and if possible user names for the domains control panel, mysql, FTP, Joomla! Super Admin, and Joomla! Admin password; do change them often. Passwords should be at least 12 mixed alphanumeric characters and contain no common word phrases.