There’s always a chance a website can be hacked, even the most secure one.
Unfortunately, it’s close to impossible to tell what vulnerabilities the hacker exploited to gain access to your site. It could be the server’s configuration, it could be WordPress, it could the plugins you’re using, it could be the theme, it could be any number of sources.
The best course of action now is to restore your child theme’s index page, and then change all passwords on your site, including WP Admin password, FTP password, server control panel password, etc.