Magento 1.9.1
Porto theme
Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his user account and recreate our user accounts. I had trouble actually re-gaining access to all the Admin features in the Admin panel but I managed to do that. This is the second time this happened in the last 2 weeks so I think I need to figure how they are able to do this?
One of the possible causes I guess is - I didn't install any security patches on top of the 1.9.1 version. I think I should do that. Is there a way to install all the necessary patches without using the Magento Connect tool? The reason I don't want to use the Magento Connect tool is - I disabled it because someone was attacking it few months ago. Also, everytime I used it for anything at all - it just ended up crashing the entire system.
Any suggestions on how I can beef up security will be much appreciated! I already reset all passwords - my Email account, server, account and Admin.