hacked!!

My first time experiencing this. Suddenly Google has warned me that my site is hacked and I have found a couple of files that indeed did have some malicious code added to them. My question here is: Does this mean someone figured out my site password in order to gain ftp access? I am very careful of my passwords so I'm shocked to see this happen. Any passwords stored in my files are stored outside of the web-accessible tree so I am puzzled. Any advice appreciated.