I wasn't home when someone emailed me about the hacked message. I don't have an index.php, but apparently they either created one or targeted my index.htm.
When I got home, I checked my site (on sidious) and found that the index.htm had been removed, so I uploaded a copy from local backup and site is working now.
If FTP is accurate, my other files at the public-html are fine based on date-stamps. Should I be checking deeper to make sure all is well?