hacked site emmaus

Hello, we are Emmaus and recently we were hacked. I don't understand how they found the login page and username because we are using an extension to hide the login page. The attack took place about 1 week ago and it seems that it is still in progress because even after having restored the backups of my December we cannot put everything in order. I see that I have to redo everything from scratch. I don't understand why we attack non-profit associations. I saw in wp_aiowps_audit_log number of hundreds of connection attempts see more .Could anyone possibly enlighten me to help? THANKS