Deal with this every day.................
Here are some ways to prevent this, and good suggestions for everyone:
First of all - make sure you have virus protection on your personal PC's that you do updates from, also get a good MalWare scanner and cleaner. If your home PC is infected and you are making updates from home then you make yourself an easy target for this.
To make a strong password:
5-7 characters min in length
Have at least 1 upper case character
have at least 1 lower case character
Have at least 1 number
If you can include 1 special character do it as well.
This is not 100% full proof but is considered a strong password and is a lot more reliable than a "1111" or a "1234" password because it is easy to remember, etc.
I hate hearing this, yet it happens so much.... "why would anyone hack my site" it happens, and happens often - just some pointers to try and prevent this.
Joomla, Wordpress... does not matter - hack is hacked.
Hope this gets fixed!