Step 1: After observing a hack/intrusion, the first step would be to take a personal copy of all of your logs from cPanel.
Step 2: Log in to the cPanel control panel
Step 3: Click on "Raw Access" and download the raw access logs.
Step 4: From there, please submit a support ticket to the web hosting support department with your log file(s) attached, along with a description of what went on, when the attack was observed, along with all additional information you may be able to provide. This will assist us in determining what went on and potentially assist you in finding the identity of the attacker.