Violated my site

I loaded Sumome after watching a webinar that recommended it. The next day my site no longer loaded and I could not get back into my site. Ended up having to pay $300 to have the plugin removed and my site cleaned up. There was a security breach. I contacted the developers about it and they basically (and arrogantly) told me that was impossible because their plugin “is a layer that runs on top of your website.” Here’s how my web designer described the problem: “The spam was running “on top” of your WordPress site!! The glitch that allowed you to see a “symptom” (not being able to login) was in your wp-config file, referencing a missing file inside your plugins folder, which had a tiny snippet of code inserted to alert browsers of the additional files that had been uploaded.” Hmmm. I think maybe their impossible to breach plugin is not so perfect after all.