It may not be hacked. It may just be returning 403 for everyone anyway.