This might solve a big mystery for me.

When I first set up my company's website it was hosted at GoDaddy. Totally static site. It got 'hacked' one day, with new php files and redirecting users to some nonsense. This was August 2016. The ftp server had a very long, random password. I changed it again after this.

It happened *again* March 2017, though different files were added. After this I moved my site to Digital Ocean.

I never found out how this happened.

Does anyone know how long this has been going on? The article didn't give a definitive start date.