Today I got a call from an administrator of Shul.lv, that it was defaced.
I checked the site and found that index.php in the theme was replaced with the page on the screenshot.
I was really lucky, that I used PHPStorm (please do not consider it as an advertisement :))
There is a very useful feature – History of file’s changes.
So, fix took less then a menute.
Passwords changed, all plugins are updated. Waiting for another try.