Wordpress Website Hacked - Needs Fix / Clean

We have a WP website that has been online for 10+ years. A few days ago, we saw that the website had virus and other files / scripts that rewrite index and htaccess page (+ others). We need the site cleaned and want to know how this happened in the first place. We change passwords (heavily encrypted) often, and very few people have access to server :(

Make sure you add WPCOMP1 to your bid or it will be considered spam, ignored and removed.