Malicious files added to my site during recent update.

In the last few days I logged onto my WordPress web site and discovered there were updates for WordPress and The three Themes.
I ran all of them and all went OK.
I have recently updated a couple of plugins also, Updraft Baackup, and Google data list displayer.

Today my websites have been locked to all and I have received a report from my Hosting company that my site as had malicious files add providing a backdoor to my site.

Questions.

How did it happen.

Can I prevent it from happening again.

Any help much appreciated.