Taxonomy hacked?

I’ve updated to version 3.9.1 for security reasons, but I might be too late – my blog now contains several spammy pages that I can’t find in the back end. They are in the format

https://www.myexamplesite.com/?tid=sunglasses-for-skiing-phPa.html

Which is, I think a taxonomy id? There doesn’t seem to be much online about a hack taking this form, so I’d like to ask whether anyone else has seen this type of spam hack in the wild and what a ‘tid’ even is, and hopefully might have some advice as to what I can do to get ris of this spam from my site?

Thanks in advance!