I am guessing you have secured your board via the latest recommendations. If so, your next best bet is to examine your server logs and back-trace the operation. There is always evidence.
Please make sure you have read about the current exploits and their fixes at vbulletin.com (announcements).
If you were currently hacked, make sure you follow the recommendations.
https://vborg.vbsupport.ru/showthrea...26#post2448326
Sorry you were hacked.