That's a pretty common way for hackers to demonstrate that they got access to your website.
Of course, it's possible that someone has access to your account credentials (hosting, Joomla, FTP). But it can also be that your website has some vulnerabilities. This is usually because of outdated software which can be exploited, allowing malicious users do all sort of things to your website.
I recently had to clean up and secure a website, on which the hosting's company malware scanner was constantly founding infected files in it.
When I started my investigation, I discovered that alongside with the actual live Joomla site, which was almost up-to-date, there were dozens of other old Joomla installations, not maintained.
It was one of those hosting accounts, that allow many websites to co-exist, but the owner was not interested in all his other site and had left them with no maintenance and upgrades.
These outdated sites/files was the entry point for the hackers and with getting access to the root directory, there were able to affect everything inside it, even the updated Joomla site.
So, a general good rule is to keep everything up-to-date and clean.
Now, if you do a google search you will find plenty of information about dealing with a hacked Joomla site and how to secure it.
Try to follow all these instructions, and when done remember to have all your accounts credentials updated.
If you feel insecure or incapable to perform these at your own, I would suggest to hire a professional to assist you.