If your VM has been hacked you have to assume that your Discourse container was hacked too.
Your backups are in /var/discourse/shared/standalone/backups/default. See Restore a backup from the command line. What I would do is Move a Discourse site to another VPS with rsync